topic Re: ISE - MAC address to user posture in Network Access Control

ISE - MAC address to user posture

manvik — Sat, 12 Mar 2022 12:18:38 GMT

Can ISE posture permit a user login from specified MAC address only. There are 2000+ users. Each user will be logging on from their system only. ie an user should be permitted from the corresponding MAC address only

Re: ISE - MAC address to user posture

Marcelo Morais — Sun, 13 Mar 2022 02:03:16 GMT

Hi @manvik ,

try the following:

1st at Administration > Identity Management > External Identity Sources > Active Directory > select your AD > Attributes > Add (for ex.: Description).

2nd insert the MAC Addr of each User into the Description attribute on your Active Directory

3rd at Policy Set > select the Policy > Authorization > create the following Condition (for ex.:)

RADIUS: Calling Station ID EQUALS <AD>:Description

Hope this helps !!!

Re: ISE - MAC address to user posture

manvik — Tue, 15 Mar 2022 04:39:00 GMT

Thank you @Marcelo Morais

That sounds like a solution. Our scenario is liek, an user has 3 to 4 devices. They can login from any of those devices. I assume, in this case we can give MAC address in diff AD parameters and refer all those in Auth policy.

Re: ISE - MAC address to user posture

Marcelo Morais — Tue, 15 Mar 2022 13:28:30 GMT

Hi @manvik ,

yes, that's correct, you can choose the AD parameters that best suit you.

Regards.