topic Re: IP Device Tracking in Network Access Control

IP Device Tracking

Raminkn20 — Thu, 16 May 2024 10:08:26 GMT

Hi guys. I want to find out about the usage of device tracking feature on Cisco switches.

When we use that?

Re: IP Device Tracking

MHM Cisco World — Thu, 16 May 2024 10:11:49 GMT

You have dACL push to SW

This dACL is permit ip any any'

But each host have IP

Here device tracking work

It make SW detect IP of endpoint and re-config acl to be

Permit ip host <> any

MHM

Re: IP Device Tracking

Greg Gibbs — Thu, 16 May 2024 22:06:21 GMT

There is also a section on this feature in the ISE Secure Wired Access Prescriptive Deployment Guide

Re: IP Device Tracking

Arne Bier — Sun, 19 May 2024 21:04:17 GMT

Strange example @MHM Cisco World - what does Device-Tracking have to do with dACL?

Device-Tracking can be enabled on any switch that supports this feature, and its primary purpose is to map the L2<->L3 on interfaces where it's configured. It literally tracks the device's L3 address, and gleans IPv4 addresses via DHCP Snooping (if configured) or via ARP probes - and in the case of IPv6, it gleans IPv6 addresses via the ND (Neighbor Discovery) ICMP packets.