topic Configure ISE MAB to allow devices on vendor ID part of mac address ? in Network Access Control

Configure ISE MAB to allow devices on vendor ID part of mac address ?

Redguy — Sun, 12 Nov 2023 14:31:01 GMT

Is it possible to setup ISE to recognize devices for MAB based on the vendor ID part of their mac addresses ?

My company builds robot solutions and uses it's own vendor code. I want to recognize our robot products as the are plugged into the network in our various test and development areas so they get assigned to the test network via NAC & ISE/MAB instead of having to register their mac addresses all the time. Those developers and test guys are busy bees and always in a rush and will plug all kinds of stuff into any outlet they see fit.

Re: Configure ISE MAB to allow devices on vendor ID part of mac addres

Rob Ingram — Sun, 12 Nov 2023 14:53:21 GMT

@Redguy yes, you can use the ISE profiling to profile the device based on the MAC OUI and/or other attributes learnt about the device. You can then return a dynamic VLAN or other settings such as DACL to the devices that match your specific profiled devices.

You may need to create a specific profiling policy to match your require MAC OUI (if not built-in to ISE already), you can combine multiple attributes in the policy.

ISE Profiling Guide for more information - https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456#toc-hId--368844690

Re: Configure ISE MAB to allow devices on vendor ID part of mac addres

Redguy — Sun, 12 Nov 2023 14:52:30 GMT

Ah great !,

I haven't reached the profiling part of my ISE training yet, but that will save me a lot of time setting up the test networks.

Re: Configure ISE MAB to allow devices on vendor ID part of mac addres

Arne Bier — Sun, 12 Nov 2023 22:22:16 GMT

In addition to what Rob mentioned (ISE profiling), you can also achieve this without Profiling. Remember that Profiling requires the medium tier license (Plus/Advantage). If you only have the Base/Essentials license you can create simple MAB Authorization Policy Rules that match on the MAC prefix hex digits. That only consumes a base license.