ISE - Profiling - MAC Address Spoofing

[nadeekha]

Hi Experts,

My Customer has Profiling enabled on the Prod ISE deployment and are correctly profiling Aruba AP's using MAB not Dot1x as the auth method.

Customer is concerned that if the MAC address of the AP's spoofed would it be used on any device linux/windows etc to gain access to the network.

The probes that they have currently setup are DHCP,Radius.

Is there a way to avoid MAC Address Spoofing in the above scenario?

Thanks

Nadeem

[howon]

Nadeem, I suggest limiting access using VLAN or ACL for AP access. The ACL can be crafted to allow for APs to join the controller, which at minimum would include DHCP, DNS, and GRE to the controller.

Hosuk