topic Re: ISE: how to extract MAC lists which are used for MAB in Network Access Control

ISE: how to extract MAC lists which are used for MAB

naoki_Japan — Thu, 07 Oct 2021 05:45:58 GMT

I want the list of MAC addresses which I manually registered by using csv.file and manually entering.

I mean the MAC lists I want is MAC lists used for MAB.

On the panel Context visibility > Endpoints, if I just click Export and download csv file, the content of file would include not only MAC used for MAB but also, unfortunately , MAC of users who logged in via dot1x.

Re: ISE: how to extract MAC lists which are used for MAB

Rob Ingram — Thu, 07 Oct 2021 09:07:46 GMT

Hi @naoki_Japan

If you export all the MAC addresses, you can open the CSV file in excel (or another program) and filter on StaticAssignment column, there are two options TRUE or FALSE. If FALSE then these are your dynamically added endpoint MAC address for 802.1x users, the remaining MAC addresses would be set to TRUE and are the MAC address you statically added.

Re: ISE: how to extract MAC lists which are used for MAB

Mike.Cifelli — Thu, 07 Oct 2021 13:46:49 GMT

Sharing a way to generate a csv file containing specific ISE endpoint group macs based on user input with python.

#!/usr/bin/python
import json
import requests
import warnings
import sys
import csv

#ignore invalid cert warnings
warnings.filterwarnings("ignore")

groupID = ("")
temp1 = ("")
temp2 = ("")

USR_CHOICE = raw_input ("Do you want to see MACs in Imaging (1) or Blacklist group(2)?")
    while USR_CHOICE not in ('1','2'):
    print "************************************"
    print "Error! You must enter 1 (ADD) or 2 (REMOVE)"
    print "************************************"
    sys.exit()
if USR_CHOICE == '1':
    groupID = '<xxx:xxx>'
else:
    groupID = '<xxx.xxx>'

API_DEVICE = "https://<ise_pan>:9060/ers/config/endpoint?filter=groupId.EQ." + groupID + "&size=100"
API_ERS_USER = "<user>","<pass>"
HEADERS = {
    'Accept': "application/json",
    'Content-Type': "application/json",
}

r = requests.get(url=API_DEVICE, auth=API_ERS_USER, headers=HEADERS, verify=True)

#print r.text
data = r.text

endPoints = json.loads(data)
print "Total Number of Endpoints in Group:",endPoints['SearchResult']['total']
print "---------------------------------------"

f = open ('Grp_Macs.csv','w')
w = csv.DictWriter(f, fieldnames = ['MAC Address','Description'])
w.writeheader()
f.close()

for MAC in endPoints ["SearchResult"]["resources"]:
    temp1 = MAC['name']
    with open ('Grp_Macs.csv','a') as csvfile:
        w = csv.writer(csvfile)
        try:
            temp2 = MAC['description']
            w.writerow([temp1, temp2])
            print "MAC Address:", temp1, "||", "Description:", temp2
        except KeyError:
            w.writerow([temp1, temp2])
            print "MAC Address:", temp1, "||", "Description:"""
            continue
with open ('Grp_Macs.csv','a') as csvfile:
    w = csv.writer(csvfile)
    TOTAL = endPoints['SearchResult']['total']
    w.writerow(['Total Endpoints:', TOTAL])

sys.exit()

Use curl to get id group strings for the specific groups. Update ers user/pass creds. Sample output of csv is as follows:

MAC Address,Description
XX:XX:XX:XX:XX:XX,description1
XX:XX:XX:XX:XX:XX,description2
XX:XX:XX:XX:XX:XX,description3
XX:XX:XX:XX:XX:XX,description4
XX:XX:XX:XX:XX:XX,description5
XX:XX:XX:XX:XX:XX,description6
XX:XX:XX:XX:XX:XX,description7
XX:XX:XX:XX:XX:XX,description8
Total Endpoints:,8

Curl example to get group id string:

curl -k --include --header 'Content-Type:application/json' --header 'Accept: application/json' --user <user>:<pass> --request GET https://<ise_pan>:9060/ers/config/endpointgroup?filter=name.EQ.<your_group_name>

Re: ISE: how to extract MAC lists which are used for MAB

naoki_Japan — Fri, 08 Oct 2021 01:04:54 GMT

Thank you.

This morning I got it by doing as you said!

Re: ISE: how to extract MAC lists which are used for MAB

naoki_Japan — Fri, 08 Oct 2021 01:06:21 GMT

Thank you sharing the code useful !!!

I can use this code in various way by customizing the code!