topic Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID in Network Access Control

ISE 3.2 BYOD - Randomized MAC addresses - GUID

llomjaria — Thu, 18 Jan 2024 12:53:33 GMT

Hello,

I have a question regarding BYOD and randomized MAC addresses.

I have implemented Single SSID BYOD flow. Users are getting onboarding, ISE is the CA server and it sends certificates to them. I have found that in certificate template I can choose to use not only MAC address but MAC + GUID too.

After successful onboarding, if MAC address changes ISE cannot identify device as BYOD Registered and users are redirected to BYOD onboarding portal again.

My question is - how can I configure ISE to use GUID as device identifier ?

Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID

balaji.bandi — Thu, 18 Jan 2024 13:18:45 GMT

check some reference discussion :

https://community.cisco.com/t5/network-access-control/ise-byod-mac-onboarding/m-p/3836332

Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID

llomjaria — Thu, 18 Jan 2024 13:25:55 GMT

Thanks for the reply!

I have checked provided discussion but it is not related to my issue.

Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID

Aref Alsouqi — Thu, 18 Jan 2024 14:44:38 GMT

Did you check that the clients actually get the right attributes in their certificates pushed by ISE? if not, you might need to make sure that you associated the certificate profile to the client provisioning policy profile. If both are correct, please share your authorization rules for review.

Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID

llomjaria — Thu, 18 Jan 2024 15:03:18 GMT

Yes, clients get correct certificates.

Please check attachment

Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID

Greg Gibbs — Thu, 18 Jan 2024 22:12:11 GMT

@llomjaria , the short answer is, you can't. See the following recent discussion on the similar topic.
https://community.cisco.com/t5/network-access-control/byod-solution-for-mac-randomized-endpoints/td-p/4994234

Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID

llomjaria — Fri, 19 Jan 2024 08:31:47 GMT

@Greg Gibbs Thank you for the response!

So user should register the same device every time MAC changes?

Re: ISE 3.2 BYOD - Randomized MAC addresses - GUID

Greg Gibbs — Sun, 21 Jan 2024 21:44:48 GMT

No, the workaround to mitigate issues with MAC randomization is to remove authorization conditions that use the MAC address from your policies as per this Field Notice.