Cisco ISE- Setup new PC need to join domain

[Sina Dy]

Dear Team,

After implement Cisco ISE, we have one challenging that facing with Desktop Support team as them need to setup windows or new PC need to join domain but after we applied NAC on switch port they can't join domain due to PC not compliance and can't access to any resource. 

Note: we're ISE administrator, for  our current when have new PC that need to join domain we help whitelist from ISE dashboard or exclude the switch port without apply low impact mode then Desktop Support team can perform join domain and install software from their checklist. and after they completed we remove from whitelist. but this is required alot teams for help and also workload and low productivity. example sometime Desktop Support team need to fix issue or re-join domain immediately but they need to contact ISE administrator or network team to do whitelist or exclusive switch port.

And our environment before apply ISE, Desktop Support team can join or re-join domain at user place.

I would seeking your advise or based practice and process step should be resolve this challenging and reduce workload to Desktop Support team.

Really appreciate for your help. 

[Greg Gibbs]

This is a common scenario with PC imaging on NAC-enabled networks due to the way Windows works. See the following Community post.

PC Imaging on NAC secured ports 

[Sina Dy]

Hi @Greg Gibbs , Thank for your sharing.

[Octavian Szolga]

Hi Sina,

Besides what Greg mentioned (which are great options, btw), some customers choose to use a database that is managed by the help-desk team where MAB/MAC exceptions are managed.

This means that any PC that needs network access and is not (yet) part of AD infrastructure has to be manually added to the database.

From your side (ISE admin) you need to carefully plan ISE authC and authZ rules for MAB/MAC exceptions so that specific DB is used (try not to break usual MAB/profiling for printers and so on).

From help-desk department perspective, they have to manage MAC exceptions.

Because the MAC exists in the DB, a specific authorization profile can be used (like have a dedicated VLAN that is filtered on the SVI/L3 interface, or use a dACL or just return access-accept with no other limiting attributes).

BR,

Octavian