topic Re: Enforce permit-ACL rules for endpoints in Network Access Control

Enforce permit-ACL rules for endpoints

blackbird_bb — Wed, 11 May 2022 06:16:22 GMT

Hi there,

We aim to enforce permit-ACL rules for each asset (endpoint device like a printer) using Cisco ISE version 3.0.

We have done the following steps:

We have created an asset as an endpoint on ISE using its MAC address.
We have created the corresponding ACL rules as Downloadable ACL (dACL) / TrustSec SGACL on ISE.

What is unclear to us is how to enforce these rules to the network, specific to the asset (endpoint), or at least to a port of a network switch to which this asset is connected. Is there any documentation that explains how to perform this task?

Re: Enforce permit-ACL rules for endpoints

Saurabh Dhakate — Wed, 11 May 2022 07:15:43 GMT

ISE Profiling is the best option for your use case. Please refer this doc for more information https://community.cisco.com/t5/security-documents/ise-profiling-design-guide/ta-p/3739456

Re: Enforce permit-ACL rules for endpoints

Rob Ingram — Wed, 11 May 2022 09:18:13 GMT

@blackbird_bb using a DACL enforcement is local to the switch the endpoint is connected to and simplier to implement.

Compared to TrustSec SGACL which is more complex to implement and support.

How big is your network? What switches do you have?

Refer to this ISE Segmentation strategy guide for more information.

https://community.cisco.com/t5/security-documents/segmentation-strategy/ta-p/3757424