topic Re: Through probes using profiling can we authorize the user in Network Access Control

Through probes using profiling can we authorize the user

RohitSingh91693 — Fri, 03 Jun 2022 18:16:38 GMT

Through probes using profiling how can we create Authorization policy set and assign the endpoints specific vlan, i have gone through various videos & documents i have understood the concept to what extent but not complete.

Because there is a rule which says, if switchport is in closed authentication then no traffic will be send except Eapol.

So how can we make Authorization policy in Policy set and authorize the user

Re: Through probes using profiling can we authorize the user

andrewswanson — Fri, 03 Jun 2022 20:26:12 GMT

It depends on the user/device attributes that ISE would require to successfully profile them.

In closed mode:

CDP/LLDP: if profiling requires these attributes, ISE can use SNMP probe to collect them from the switch (they can also be sent in Access-Request if you are using ibns 2)

DHCP: if profiling requires DHCP attributes, ISE could authorize with a DACL that permits DHCP only. ISE can get these attributes with DHCP probe

NMAP: if profiling requires port/OS attributes, ISE could authorize with a DACL that permits only the required ports (with the PSNs as destination).

hth
Andy

Re: Through probes using profiling can we authorize the user

Marcelo Morais — Fri, 03 Jun 2022 21:00:55 GMT

Hi @RohitSingh91693 ,

beyond what @andrewswanson said ... please take a look at: Cisco ISE Device Administration Prescriptive Deployment Guide, search for Device Admin Policy Sets.

About Probes ... remember that:

1st Network Probe is a method used to collect an attribute or a set of attributes from an Endpoint on your network. It analyzes received Network Traffic (ex.: RADIUS, SNMP, DHCP, HTTP and more) by collecting Endpoint Attributes.

2nd Most Probes are passive ... traffic MUST be delivered to ISE.

3rd It is NOT recommended to configure ALL Probes, especially in a Production Deployment, as this may result in excessive data collection than is required to achieve the desired goal !!!

Note: you are able to enable Probes at Administration > System > Deployment > select the PSN > select Profiling Configuration tab.

Hope this helps !!!

Re: Through probes using profiling can we authorize the user

ahollifield — Fri, 03 Jun 2022 23:25:15 GMT

Use low-impact with dACLs instead of closed mode.