topic 802.1X(AD) + MAC Filtering via ISE in Wireless

802.1X(AD) + MAC Filtering via ISE

rlwilson — Tue, 20 Feb 2024 20:12:08 GMT

I currently am only doing 802.1X(AD) on the SSID. My users have figured out they can get their personal iPhone on the SSID by entering their AD credentials. I would like to do 802.1X(AD) + MAC Filtering via ISE. This way the device would have to be in the MAC allowed group plus their AD credentials. Does anyone how I can accomplish this?

Re: 802.1X(AD) + MAC Filtering via ISE

Karsten Iwen — Tue, 20 Feb 2024 21:29:53 GMT

This is nothing more than an additional condition in the corresponding rule in the authorization policy. But it is also an administrative nightmare.

The better solution would be to use TEAP with EAP-Chaining.

Re: 802.1X(AD) + MAC Filtering via ISE

aleabrahao — Tue, 20 Feb 2024 21:42:03 GMT

There is all the information that you need.

https://documentation.meraki.com/MR/Encryption_and_Authentication/MAC-Based_Access_Control_Using_Cisco_ISE_-_MR_Access_Points

Re: 802.1X(AD) + MAC Filtering via ISE

jgbright — Tue, 20 Feb 2024 22:14:42 GMT

If you have deployed Meraki Systems Manager on your corporate wireless assets, but not the employees personal devices, you can also filter on whether the Systems Manager agent is on the wireless device too.

Re: 802.1X(AD) + MAC Filtering via ISE

Karsten Iwen — Wed, 21 Feb 2024 10:56:08 GMT

Another better solution is to give them internet access on a dedicated SSID (for example, the Guest SSID) for their personal devices.