Creating device policies

[Areyesibarra]

Friends, I want to create policies so that certain devices can not connect to a specific SSID. For example that the devices android, apple can not connect but if devices with S.O windows in all its version. The policies I want to create on the ISE 2.2 server. Currently these policies are configured in my controller 2504 in local policies.

Please support them.

Thank you.

[Arne Bier]

Alejandro

How do you currently do that in your 2504 controller?

In ISE I would imagine that you should do this via device profiling (Profiling requires a PLUS license on top of BASE license) - the profiler would look at multiple attributes of the device to build a "certainty factor"  that you have profiled the device correctly.

If you wanted to do this based on the OUI (Manufacturer MAC address prefix) then you might be able to filter out the majority of devices, but it would take effort, because Android comes in many flavours.

[hslai · Accepted solution]

Adding to Arne's... Please review "Profiling and Authorization Policy" section inHow To: ISE Profiling Design Guide, which starts at page 118.

In case your inquiry is more towards AVC, please go over Application Visibility and Control Feature Deployment Guide and then consult the support resources at Wireless if you have further question on that.

[Areyesibarra]

Thanks for your comments.

Currently the policies are in the driver.

I will follow the documentation and advice provided, I hope everything goes well.

[Areyesibarra]

Good morning friends.

Thank you for the contributions and advice, the inconvenience and solve it.