topic Re: unique IP-MAC relationship in Cisco ISE in Network Access Control

unique IP-MAC relationship in Cisco ISE

monica.martinezr — Wed, 14 Dec 2022 09:02:19 GMT

Hi team

Would there be a way in the Cisco that only allows an IP-MAC relationship? As a security measure, that an Ip is only possible to be assigned to a MAC, preventing someone to turn off a computer with a fixed ip administrator and put on your computer that IP and can access sites by having that IP.

It would be a reduced list of ips that would be assigned to a mac.

Regards

Re: unique IP-MAC relationship in Cisco ISE

balaji.bandi — Wed, 14 Dec 2022 09:35:22 GMT

DHCP reservation IP to MAC - most of the controller network - PC are locked not to change network settings.

you can also looking to port security.

Re: unique IP-MAC relationship in Cisco ISE

Rob Ingram — Wed, 14 Dec 2022 09:54:45 GMT

@monica.martinezr Defining rules based on IP addresses if not very scalable. Instead of limiting access based on IP address, use ISE to authorise users based on group membership in AD, assign policies that permit that AD user group or use TrustSec SGTs to control the access to resources.