Create Policy Set that uses Condition that Filters on Endpoint Mac Address

[Matthew Martin]

Hello All,

ISE: v2.3

We originally created our Policy Sets in previous version so this section was way different then it is now and I'm having trouble finding a specific condition to have a policy set match on.

I'm trying to create a test policy set that would match a Client/Endpoint Mac address. It appears the client mac address shows up under auth details as Endpoint ID, Calling Station ID, and EndpointMacAddress. But, I cannot find any of these conditions.

Can someone tell me where I can find any of those conditions so I can make it so the Policy Set will only match for one specific Mac Address?

Also, is there anyway to search/filter ALL possible conditions instead of having to clicking through each of the little icons shown in the "Select attribute for condition"?

Thanks in Advance,

Matt

[paul · Accepted solution]

You should be able to use the RADIUS calling station ID:

Then I could write a condition for that:

Then reference that in the policy set.  I would never setup a policy set this way, but it should work.  I would use a test switch or test SSID that has its own policy set.

[Matthew Martin]

Thanks for the reply.

Strange, I didn't see the calling-station-id before, but I do see it there now. Thanks!

-Matt

[Mike.Cifelli]

Can someone tell me where I can find any of those conditions so I can make it so the Policy Set will only match for one specific Mac Address?

You have a couple of options to achieve what you are looking for:

1-Create a local ISE Layer 2 identity group with your specific MAC in the group; Then add the following condition in your policy set: under identity group->IdentityGroup Name = new group you created with your MAC

2- In your ISE radius live logs if you view the details you should see that if a host authenticates via MAB then the Radius username is the MAC.  You can then use that in your policy set:

Under subject: Radius dictionary - user-name (username string being the MAC)

Also, is there anyway to search/filter ALL possible conditions instead of having to clicking through each of the little icons shown in the "Select attribute for condition"?

Ensure that when you click to add an attribute inside of your policy that you do not select any of the icons & your Dictionary column is set to All dictionaries.  This will allow you to scroll through everything instead of clicking each icon.

[Matthew Martin]

Thanks, didn't realize you could unclick the icon for the different categories to view and filter on all attributes.

Thank you!

-Matt

[paul]

Yeah I never use those silly icons.

[Matthew Martin]

Quick question...

Kind of off topic but its part of the testing I'm doing.

I created a new Test Posture Policy as well. Would it be possible for an endpoint to match multiple posture policies? It appears that the endpoint is hitting my new test Posture Policy as well as the normal one we use for all the other PCs in the company.

Is there anyway to make it so it stops checking for more policies after it hits my test policy? My test policy is actually showing at the very top of the posture policies list, wasn't sure if it sequentially went through all the policies and would match on multiple ones if it had the correct attributes?

I actually decided to use a AD Group I created to match the test policies and put the PC I'm testing in that AD Group instead of using the Mac Address...

-Matt

[paul]

The posture policy is multi-match as it has to be since you could have multiple posturing rules applied. You can add the Not member of conditions to the other rules to ensure your device doesn't hit those.

[Matthew Martin]

Perfect, thanks again!

-Matt