topic Re: Cisco ISE dACL and L2 switch in Network Access Control

Cisco ISE dACL and L2 switch

Script Kiddie — Mon, 20 Nov 2023 15:39:06 GMT

Dear community,

I'm pretty new at Cisco ISE, however I have very essential question.

My goal is to prepare isolation rules, I was reading about Adaptive Network Control and options it goes with.

I think Acces-Reject option will be the best, but we use different deployement modes, and from what I know it works only in "Close" mode, on the other hand, switch in "Monitor" mode ignores "Access-Reject" messages. I have also tested it.

Then my idea was to create dACL with deny any.

And here goes the question: How can L2 switch process ip deny any dACL?

My ultimate goal is to isolate the host and as a result the host should not be able to communicate with any other host on other vlans, not even on the same vlan. I think this cannot be reached with dACL on L2 switch.

I'm open to any ideas, thanks.

Re: Cisco ISE dACL and L2 switch

MHM Cisco World — Mon, 20 Nov 2023 16:01:28 GMT

Check below

MHM

Re: Cisco ISE dACL and L2 switch

Script Kiddie — Mon, 20 Nov 2023 15:28:44 GMT

Can you explain, please?

Re: Cisco ISE dACL and L2 switch

Rob Ingram — Mon, 20 Nov 2023 15:51:01 GMT

@Script Kiddie if you wish to isolate hosts and prevent them communicating with any networks/vlans, then why not dynamically place them into an unrouted vlan, that way they will not have an IP address to communicate with other devices. Else I see no reason why a DACL would not work, TrustSec SGT would be the preferred segementation solution to prevent lateral movement.

Re: Cisco ISE dACL and L2 switch

MHM Cisco World — Mon, 20 Nov 2023 16:00:57 GMT

dACL is add as port ACL so it can use to isolated any host connect to that port from any other host ( in same or different vlan).

Only router ACL need l3 interface (l3 sw).

Re: Cisco ISE dACL and L2 switch

Script Kiddie — Mon, 20 Nov 2023 19:54:41 GMT

Dear all,

since I'm addressing here two different topics, I've decided to create two discussions:

How dACL works on L2 switch?
Cisco ISE - downloadable ACL (dACL) and Layer 2 switch - Cisco Community
Best and simplest way to isolate a host?
Cisco ISE - host isolation options - Cisco Community

Please feel free to join them. Thank you for your answers already.