topic Re: VPN users in Cisco ISE in Network Access Control

VPN users in Cisco ISE

Asfandyar70754 — Fri, 18 Jun 2021 11:05:56 GMT

Hey guys,

Good day.

I have some vendors and some 3rd party users in my network but they are not in my Active directory but some of those users access network using VPN, but after deploying ISE can I somehow bind the MAC addresses of vendor's laptop, as these users are not in my AD. Is there some feature in ISE that can address this issue.

TIA

Re: VPN users in Cisco ISE

Rob Ingram — Fri, 18 Jun 2021 11:17:26 GMT

@Asfandyar70754

No ISE won't learn those laptop MAC addresses.

What VPN are they using? If using ASA or FTD then you can create a custom tunnel-group for those users and then in ISE use the radius avp "Cisco-VPN3000:CVPN3000/ASA/PIX7x-Tunnel-Group-Name" EQUALS <NAME>. You can then filter traffic sourced from that tunnel-group and authenticate against the ISE local user store.

Re: VPN users in Cisco ISE

thomas — Sun, 27 Jun 2021 22:45:26 GMT

VPN uses Layer 3 (IP) and not Layer 2 (MAC).

I don't understand what you want to do with ISE with your vendors/third-party users.

Re: VPN users in Cisco ISE

hslai — Mon, 05 Jul 2021 03:32:10 GMT

If using Cisco AnyConnect with ASA, ISE can learn the MAC addresses from ASA.