topic Re: ATM Machine profiling in Network Access Control

ATM Machine profiling

manasjai — Thu, 29 Nov 2018 13:55:33 GMT

All,

I am looking for ISE profiling attributes for ATMs for a banking customer. These devices are non-Dot1x capable and have a static IP address assigned.

Has anyone done something similar before?

Regards,

Manasi Jain

Re: ATM Machine profiling

Arne Bier — Fri, 30 Nov 2018 11:00:12 GMT

It's one thing to rely on ISE to profile an IOT device (like a light bulb) and work with a "certainty factor" percentage accuracy. But I would be worried if my bank used profiling to assign its ATMs to the correct VLAN or assign ACLs etc.

What is the reason for using Radius here? if they don't do 802.1X to gain network access then could you not do MAB auth instead? That would mean putting all the ATM's MAC addresses into an Identity Group. But MAB auth for an ATM sounds dodgy too. I don't see what they use case is here.

Re: ATM Machine profiling

SHABEEB KUNHIPOCKER — Mon, 11 Mar 2024 22:40:15 GMT

Hello,

I am looking for the same. Kindly advise

Re: ATM Machine profiling

Pulkit Mittal — Mon, 11 Mar 2024 23:14:49 GMT

Hi Manasi,

The best way to handle non dot1x devices is to create a custom identity group for all atm machines. These devices do not need to be connected to be added to the group, they can be imported.

This solution has been explained in detail here from Timothy Abbott. I believe its applicable in this case for you.

If you find this useful, please mark it helpful and Accept the Solution.

Re: ATM Machine profiling

Pulkit Mittal — Mon, 11 Mar 2024 23:18:58 GMT

Hi Shabeeb,

It's answered, follow the same approach.

Regards,

Pulkit

Re: ATM Machine profiling

Greg Gibbs — Mon, 11 Mar 2024 23:17:57 GMT

As @Arne Bier inferred in his previous response, you are not likely to get much detail from Profiling of an ATM endpoint. From my experience, most ATMs are built on generic platforms (like old Windows OS), so they would not provide any unique attributes.

If you intend to pursue the Profiling route, you would need to determine what the network can glean from one of the ATM endpoints and build custom Profiling conditions/polices based on the ISE Profiling Design Guide.