Authentication host-mode multi-auth

[Pete C]

if you configure AUTHENTICATION HOST-MODE MULTI-AUTH on your switch port allowing a single device in the voice domain and multiple devices on the data domain, is it possible to limit the number of devices on the data domain. For example, a single phone and 2 devices but not 3.

thanks

[Marcelo Morais]

Hi @Pete C 

 please take a look at the following presentation: Cisco Live BRKSEC-3690. (search for ip device tracking).

Hope this helps !!!

[thomas]

See ISE Secure Wired Access Prescriptive Deployment Guide > MAC Limits :

This does not limit the number of endpoints from connecting or authenticating on the port. Use limit address-count maximum CLI under the device-tracking policy to limit the number of endpoints allowed to use identity-based services.

c9300-Sw(config)#device-tracking policy IPDT_POLICY
c9300-Sw(config-device-tracking)#no protocol udp
c9300-Sw(config-device-tracking)#tracking enable
c9300-Sw(config-device-tracking)#limit address-count 10