Block Kali-Linux using Cisco ISE

[anonymus1]

Hi All,

We’ve recently implemented Cisco ISE in our environment and are now looking to enhance our network security by blocking all Kali Linux systems from gaining access to the network.

I would appreciate any guidance or best practices on how to effectively detect and block these systems using ISE. Whether it’s through profiling, custom conditions, or policy sets—any suggestions or recommended approaches would be helpful.

Thanks in advance!

[Kasun Bandara]

@anonymus1 hi, this can achieve with profiling. check below links to understand how profiles working and how can it implement.

https://www.thesecurityblogger.com/cisco-identity-services-engine-ise-profiling-profiler-explained/

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217818-configure-cisco-ise-3-1-posture-with-lin.html

[anonymus1]

Hi @Kasun Bandara. Thanks for the response. I understand that this can be achieved by profiling.Any idea on this can be achieved specifically for Kali-Linux?

[anonymus1]

Found a workaround.

https://bst.cisco.com/bugsearch/bug/CSCvz45806?rfs=qvlogin