ISE posture using meraki and call home list

[aravikumar]

Hi All,

As Meraki MS series switches does not support named ACL being pushed from ISE, we are using Call Home List feature in ISE to configure posture. The posture is happening completely and the endpoint is being allowed access to the network. In our environment, the AD credentials of the user got expired. From the login screen, the user will not be having access to AD prior authentication, therefore the user is forced to use the cached credentials (old credentials). In order to provide access to certain resources including AD prior authentication, we should be able to push named ACL from ISE to meraki switches. But unfortunately this is not supported in meraki switches. Even the url redirected walled feature is supported from MS 350 series and above, but using that is also not a feasible solution as there might be "n" number of domain controller IPs in an environment.

I would like to know if there is any way to get around this or get this fixed?

Thanks,

Aravind Ravikumar

[Surendra]

How is the access being restricted prior to authentication ? Allow access based on the ports 88, 389, 464, 3268, 3269, 53 instead of IP Addresses. If you have any special services offered by the domain controllers apart from the ones mentioned here, please allow them too.

[aravikumar]

During or before posture redirection, there is only access to ISE PSNs. There is no way in meraki switch configuration (access policy) to allow the ports.

[Timothy Abbott · Accepted solution]

This is a limitation of Meraki MS.  Please work with the Meraki team to enter an enhancement request.

Regards,

-Tim