Cisco ISE 2.1 - Enable only one profile on a Cisco switch

[mccabep]

Hello,

We are currently using Cisco ISE 2.1. (Soon to be upgrade) A question has come up that I'm hoping someone can answer. One of our cisco switches (2960c), is not behind locked door. This is a security threat, so I was told to enable ISE on the switch, which I have. However, now I'm being asked if the switch can be locked down further, meaning, only allow one profile to access the switch. So if we have our corporate desktops profiled, we would want only those desktops to use the switch. I hope that makes sense.

[Arne Bier]

You can implement that by adding an AND condition to your Authorisation Rule that says If ... blah AND DEVICE_LOCATION = "SPECIAL_CAT_2960C" then Permit...blah. - in other words, use the NDG DEVICE LOCATION attribute in your Policy Set logic.