topic Re: Access policy for MyDevices Portal in Network Access Control

Access policy for MyDevices Portal

vigogne — Fri, 26 Mar 2021 05:45:04 GMT

Tell me please. Is it is possible to create an access policy for the MyDevices portal to allow access only to a certain group in AD?
At the moment, I have done this way:

In the Identity Source Sequences at MyDevice_Portal_Sequence I left "Internal Users" Identity Source only. Then I added the Network Access User with the same name as in the AD Database and password type as AD Sequence.

It works, but it is very inconvenient and not flexible.

And second question. How can I modify MyDevices Portal for add in standard form combo-box with selecting endpoint group?

Re: Access policy for MyDevices Portal

Damien Miller — Sun, 28 Mar 2021 00:09:22 GMT

Unfortunately you have stumbled upon an area that has frustrated many. As you found, the RBAC for the My devices portal is non existent, you map AD then everyone has access. This certainly is not an ideal situation for the vast majority of use cases. Compounding the issue, the portal is tied to a specific endpoint ID group, you need a portal per ID group you want to add endpoints in to. Due to this, it's almost always better to build an external portal leveraging the ERS APIs so you can do RBAC and endpoint ID group selction.

If a portal per identity group doesn't deter you, then you can look at Craig's old guide on adding RBAC to the my devices portal. Craig's document is old, and full of 1.3 screenshots, so it looks different, but it's all still valid.
https://community.cisco.com/t5/security-documents/ise-sponsor-amp-my-devices-authorization-on-secondary-attributes/ta-p/3641379

Re: Access policy for MyDevices Portal

vigogne — Mon, 29 Mar 2021 04:57:11 GMT

Thanks a lot for your answer. It is regrettable to hear about such shortcomings in a program created for precisely these purposes.

But how about my second question? Can I customize the Mydevice Portal for adding combo-box with select a Endpoint Identity Group?

Re: Access policy for MyDevices Portal

Damien Miller — Mon, 29 Mar 2021 19:54:28 GMT

It is not possible to add an identity group selection to the built in my devices portal, you need a unique portal per ID group.

Re: Access policy for MyDevices Portal

vigogne — Tue, 30 Mar 2021 05:50:44 GMT

Weird flex, but ok )