Creating DACLs for Protocols such as SMBv1

[JacobEdmondson82]

Our organization is looking at blocking SMBv1 traffic during our network segmentation project and would like to do so using Cisco ISE and by protocol, not port. I have not been able to find any specific guide with an answer that this is possible outside of just using basic ports in the DACLs. Can anyone confirm if this is possible for blocking protocols?

[Greg Gibbs]

It sounds like you're asking if ISE is capable of doing Deep Packet Inspection to determine if the underlying service is related to SMBv1.

ISE uses the enforcement capabilities of the network devices (e.g. switches). As the switches do not support this type of DPI, ISE cannot support it.