Add static endpoint to GuestUser without DevicePortal

[advuni-af1]

Hello everybody,

my customer has the requirement, that admins must register special devices for the network. The normal users are not allowed to register this devices self. Only one device for one AD user (phone in WLAN). When this AD user want to register a special device (Alexa for example) the user has to provide the MAC address to the admins. The admins then add this MAC to the endpoint group. This is fine. Now the customer admin now wants to link this mac address to the AD User/GuestUser which already has registered the phone. The admins want to see the link from the manual registered MAC to the Username, so that the admins see all devices from one customer/guestuser. Is it possible? I didn't find anything.

Best regards, Alex...

[pielunswe]

Hi!

I think you need to create an own "webportal" (not in ISE), and from there enter the information in to ISE with API. We have this feature setup on an external server, with AD-login, to track and restrict users, when they add an mac-address into ISE (via API), this is logged and we also have restrictions so some users can only add mac-adresses into one MAB-group in ISE, while some can add mac-adresses to all MAB-groups (for different network access) 

[Arne Bier]

The API method is probably the most convenient and best long-term solution, but it requires some development effort.

Have you tried the CSV import under Context Visibility to create a template to allow the admins to import the endpoints into their Endpoint Identity Group(s), with MAC address and Username fields populated?

Context Visibility filters are also a great place to browse the contents of Endpoint Identity Groups. If that doesn't scale for you, then you're going to have to look at API solutions.

[advuni-af1]

Ok, I will have a look for the API method. Do you know if there exist an open source project for this? 

I will speak with the customer for a valid solution. If there are no other options the customer properbly have to use the endpoint description field.

Best regards, Alex...