Cisco ISE AAA Policy

[hanguye3]

Hi team,

Our customer is asking us AAA policy as below: only "domain user + MAC address" can access to their internal network.

Can ISE support the combined the condition like that? We are using the ISE 2.4 Patch 8.

Highly appreciated for your quick support. thanks in advanced.

Br,

hainm

[jj27]

Yes, if they are doing 802.1x to authenticate the domain user, you can check AD group membership and also in the same policy require the endpoint MAC address to be defined or part of a group.

Example AuthZ policy:  If AD Group = Domain Users AND Endpoint Identity Group = Whitelist (or whatever you want to call it) then permit access.