adding MAC prefix within ISE

Jeremy.A.Smith — Fri, 14 Jan 2022 17:00:51 GMT

We are currently attempting to have internal devices connect to SSID via MAC within ISE; however, I am attempting to configure ISE using just the prefix of the MAC addresses (1st 3 octets) as all of the devices with start with the same prefix. There are hundreds of devices requiring this connection and was wondering if this is possible?

ISE version 2.7

Re: adding MAC prefix within ISE

Mike.Cifelli — Fri, 14 Jan 2022 17:34:06 GMT

however, I am attempting to configure ISE using just the prefix of the MAC addresses (1st 3 octets) as all of the devices with start with the same prefix.

-One option you have would be to rely on device profiling. Essentially you would profile those devices with some condition (for example MAC:MACAddress STARTSWITH then have the first 3 hex since all the same). You would then setup the profiler policy to create an identity group which would place your profiled devices in that group. From there within the radius policies you would utilize this profiled endpoint group as an authz condition + any other conditions you desire for device onboarding. The catch here is ensuring that the devices meet the MCF and are profiled properly otherwise you may have difficulty. Lastly, this requires the following licensing (depends on your ISE version):

legacy - plus licensing

new model - advantage licensing

Take a peek here at the following resources:

ISE Licensing Migration Guide (cisco.com)

ISE Profiling Design Guide - Cisco Community

Re: adding MAC prefix within ISE

Jeremy.A.Smith — Fri, 14 Jan 2022 17:36:21 GMT

Thank you Mike I will give that a try!

topic Re: adding MAC prefix within ISE in Network Access Control

adding MAC prefix within ISE

Re: adding MAC prefix within ISE

Re: adding MAC prefix within ISE