Cisco İSE authentication

[teymur azimov]

Dears,

I have ipad and authenticate from ISE. In our company someone is hacker  and have the same model of ipad and put my ipad mac address in his ipad. Can he connect to network?? He also know the username and password.How ISE identify the hacker ipad? i

[Saurav Lodh]

Yes he can access the network, moreover, if BYOD is supported , he can easily register any device using your AD credentials. One scenario, where he cant use that device is when devices with certificates installed manually ( no SCEP ). Then the device he would be carrying shouldnot be having certificate installed using your AD.

[kaaftab]

yes you are right but with profiling and posturing you can also identify certain application or apply fingerprinting and rule combination to limit this .

However certians posiblities will always remain and main concept is always to make it difficult.

[nspasov]

If the username and password are known then you are going to have bigger issues to worry about :) The iPad MAC address will not matter unless you are only using the MAC addrss to autenticate to the network. Even Profiling is not guaranteed to protect you against MAC spoofing. 

A better way to protect your network is to use PKI  (EAP-TLS autnentication)

Thank you for rating!