can we limit 1 device per SSID and per user ID on ISE?

[jpoh]

Hi Team,

my ISE customer has two SSID, SSID_Prod and SSID_Internet. SSID_Prod is for office laptop where it went thru posture validation. SSID_Internet is for staff's own devices and can only go to Internet. Both SSID is using staff_ID to do authentication.

Can we limit only 1 device per SSID_Internet per user ID? This mean 1 staff can only have 1 device connected to SSID_Internet.

Appreciate for your advise

Regards &

Have a nice day

[tertang@cisco.com]

Only the Guest and BYOD flows supports that now.

You don't have that control for normal network access users.

[Jason Kunst · Accepted solution]

There is not a way to do this directly, you could profile corporate resources or put them into an endpoint database and now allow them to connect to the internet SSID for example

if corporate device and WLAN ID then deny access or send them to a portal that says (see hotspot message portal under guest and web auth)

If non-corporate and internal ID then deny access or send to a message portal.

[jpoh]

Thanks Jason,

how about limiting 2 devices per user ID? Each staff will have 1 corporate laptop connecting to SSID_Prod. This will left 1 device for staff to connect their own smart phone to SSID_Internet. They are using 802.1x with their AD credential.

Regards &

Have a nice day

[Jason Kunst]

If you're using AD credentials you could send them through BYOD for their personal devices and only allow them to register 1 device in the BYOD portal.

For corporate devices you can put a corporate certificate on them and only allow those devices to access the internal network. Or register their MAC addresses for their corporate machines and based access of an endpoint group.