topic Re: How to limit bandwidth for Wired Clients on a per user or Group ba in Network Access Control

How to limit bandwidth for Wired Clients on a per user or Group basis?

Ferdaush — Thu, 13 Oct 2022 05:43:04 GMT

Hi Experts,

we know that Cisco ISE is a security policy management platform that provides secure access to network resources, can we do bandwidth control by Cisco ISE policy for Wired clients (802.1x Clients) on a per user or gruop basis?

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

balaji.bandi — Thu, 13 Oct 2022 07:09:42 GMT

may be you need to manually configure on the switches?

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Ferdaush — Thu, 13 Oct 2022 08:53:48 GMT

Thanks a lot for your comment but I think there should be way bind policy with Switch like Cisco WLC. If you have any idea

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

balaji.bandi — Thu, 13 Oct 2022 09:54:32 GMT

Wiress is different compare to Wired network.

You can use QoS policies as suggested.

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Rob Ingram — Thu, 13 Oct 2022 09:57:06 GMT

@Ferdaush You can authorise the users by AD user or group membership and then dynamically send the specific RADIUS attributes. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_radatt/configuration/15-mt/sec-usr-radatt-15-mt-book/sec-rad-att-AAA-per-VC.html

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

balaji.bandi — Thu, 13 Oct 2022 10:05:18 GMT

Just to clarity is this works on Ethernet port ? (never tested) - but keen to know.

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Ferdaush — Thu, 13 Oct 2022 11:15:31 GMT

Yes, Ethernet port.

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Ferdaush — Thu, 13 Oct 2022 11:21:54 GMT

I idea is use Cisco ISE instead of Packetshaper system in some cases. May be control network bandwidth by user or AD group basis. Thanks @balaji.bandi and @Rob Ingram for your response.

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Rob Ingram — Thu, 13 Oct 2022 11:25:36 GMT

@Ferdaush another option you could apply the QoS configuration (and other settings) in an interface template. Then from ISE use the authorisation profile to define the interface template and assign this on a per AD group basis.

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Ferdaush — Thu, 13 Oct 2022 12:17:15 GMT

Thanks, I am looking for the QoS configuration example or solution for the Cisco Catalyst 9300 Series Switches and ISE Authorization profile idea. I did applied worksome but not as expected output gotten. I used AuthZ profile for Cisco:cisco-data-rate Radius advance attributies.

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Ferdaush — Sun, 16 Oct 2022 09:30:25 GMT

Could you please share "QoS configuration (and other settings) in an interface template" if you have any @Rob Ingram

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Ferdaush — Wed, 26 Oct 2022 12:43:38 GMT

I am getting some idea from below materials but still working on it.

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

https://www.wiresandwi.fi/blog/solid-config-cisco-ibns-2-0-802-1x-mab-switch-configuration-ios-xe

Re: How to limit bandwidth for Wired Clients on a per user or Group ba

Ferdaush — Wed, 26 Oct 2022 12:54:00 GMT

One More document found as below link:

https://community.cisco.com/t5/security-knowledge-base/neat-with-interface-template/ta-p/3642967