topic Re: IPSK without MAC address in Wireless

IPSK without MAC address

Emiliano Luca — Mon, 05 Jul 2021 18:01:16 GMT

I would like to use IPSK and I undestrood it works like this:

-I will configure one only common SSID
-user who will connect to IPSK_SSID and use PSK_123 will be connected to VLAN 123
-user who will connect to IPSK_SSID and use PSK_456 will be connected to VLAN 456

-user who will connect to IPSK_SSID and use PSK_789 will be connected to VLAN 789

And this will be great.

What is not clear to me is: before any user will be able to use PSK_XXX do I need to know his MAC address?

Is it really mandatory to know their mac address before they will be able to connect to the IPSK SSID ?

Is there any way to bypass this with a wildcard that acceprt any mac and checks only PSK to decide to admit or not the clients?
My goal is to admit all clients that have the correct PSK because (for many reasons) I'm not able to produce a coplete database of all mac address they have now and particularly I'm not able to foresee what mac they will have in the future.

Thank you in advance for your help

Re: IPSK without MAC address

Flavio Miranda — Wed, 18 Sep 2019 13:07:32 GMT

Yes, you do. There´s no wild card for mac address as it can change significantly according with the vendor.

This link below will drive you very very well on this configuration, including RADIUS.

https://ripplesinharmony.wordpress.com/2019/03/11/implemen ting-cisco-ipsk-with-ise/

-If I helped you somehow, please, rate it as useful.-

Re: IPSK without MAC address

Haydn Andrews — Thu, 19 Sep 2019 05:24:36 GMT

Correct you need to add their MAC addresses to your RADIUS server before they can connect. No wildcards unfortunately.

Keep an eye out as Cisco was talking about releasing something around on boarding IOT devices for this use case to save having to manually adding every MAC address. This was mentioned at MFD4

Re: IPSK without MAC address

igaffine — Tue, 27 Apr 2021 19:23:22 GMT

Hi Community,

Just wanted to get an update on this topic in case changes have occurred in later ISE versions. As with the original poster of this topic, I have a similar situation where a customer would like to rationalise a number of PSK services using iPSK, however, they don't have a complete list of devices & MAC addresses as these are 3rd systems that come on the network as and when.

Ideally if iPSK would allow any MAC address to connect as long as they had the valid PSK, then this would tick the box. I have seen the onboarding iPSK portal with iPSK Manager, which looks really good, but does not fit my customer requirement this time. The customer could look to run reports on the clients connecting to the wireless services via Prime Infrastructure and capture the MAC addresses over time, but this could take time too.

Alternatively, is it possible to allow ISE with iPSK Manager to allow any MAC address to connect as long as it has the valid PSK, and then perhaps iPSK Manager then registers that MAC for future connections.

Unfortunately I am after an onboarding process without the need for the client or the customer to onboard their devices 😞

Kind regards,

Ian

Re: IPSK without MAC address

Scott Fella — Tue, 27 Apr 2021 23:43:43 GMT

You can just create a catch all rule for end devices that are in the default endpoint group. This way you allow the devices and also capture the device mac address.

Re: IPSK without MAC address

igaffine — Wed, 28 Apr 2021 08:04:25 GMT

Hi Scott, Thanks for your reply. Is that default group in iPSK Manager? My example would be migrating three SSIDs for three different 3rd parties, each having different PSKs. We would create one SSID with iPSK, and then tell the 3rd parties to connect to that with their old PSK information. Therefore this catch all could see clients connecting with three different PSKs. Would that work?

Alternatively, we would give them a new PSK and then tell them to use the iPSK onboarding process. But ideally we are looking at a way of doing this without iPSK Manager, as the customer is not comfortable with an unsupported platform.

Am I correct in assuming that wildcard MACs are still not allowed on ISE (as per Haydn's response)?

Any news on whether iPSK Manager is being integrated into ISE?

KR, Ian