Good Evening all,
I have an issue that i am hoping you can help me with as I didn't get much joy from Cisco support.
Some guest devices connect via docks (mainly surface docks and the odd Dell), these devices hit a CWA redirect policy, sign in with credentials and then get MAC authenticated and the device is added to an endpoint identity group. We are seeing sessions being linked to the MAC address of the dock, if one device connects via a dock, authenticates and is subsequently disconnects and then a different device then connects the new device is automatically authenticated with the previous guest users credentials (and MAC address of the dock) as this has already been added to the endpoint identity group. We believe we can setup a schedule to remove all device mac addresses from the identity group every day, but this doesn’t work for hot desks where multiple devices could connect to the same dock throughout the day.
1. Have you come across any issues like this before and do you have any suggested solutions?
2. Is it possible to remove a device identity after a period of inactivity?
a. If possible, how would this work given that the ethernet connection via the dock is never disconnected?
Ultimately our end goal is to enable 802.1x on all of our user switches, query intune (MDM) to see if the device is a corporate/compliant device and then put it on the corporate VLAN, should the device fail the intune check then to redirect them to a portal to log in and authenticate. I have the MDM part sorted but I am struggling with docks and USB network adapters.
Any help is appreciated.
