Cisco ISE 3.0 Groups for Clients

[jtimmer1]

Hi all,

We are implementing ISE on different locations with different endpoint groups. Every type of endpoint is staticly assigned to one of the groups.

For now we are looking for another solution.

In one of the locations has many different departments for Clients. the department facilitates some devices for the clients. Like Sonos Speakers, Chromecasts and TV's

Now we looking for a solution so somone can put all these items for 1 department in the group. so they can not mess around with devices in another group.

Is there any solution. like kind of a sponsorportal. so the mac adresses can assigned to a group and the group gets access to the network? We already tried to make new static groups. but because we having more than 50 departments, that is not the best solution.

Regards Jacco

[thomas · Accepted solution]

ISE does not have a portal for endpoint group management as you are asking.

The only way to accomplish this would be with ISE ERS APIs:

• Create an Endpoint Group and Assign an Endpoint
• Create Endpoint Group
• Create Endpoint
• Create an Endpoint with Custom Attributes
• Define ISE Endpoint Custom Attributes
• Create an Endpoint with Custom Attributes

The only problem here is permissions - ISE REST APIs currently have only Read+Write or Read-Only controls so anyone would be able to add any endpoint to any other department/group.

You would need to create your own web application that enforced the permissions for the people in the respective departments/groups then used the ISE REST APIs to make the changes for them.