Does MAC binding in ISE with 802.1x and MAB is possible???

[prashantk]

Dear All,

We have recently installed ISE ,PRIME and AD in our educational institute environment. Now we want to bind mac add of all client devices in ISE itself instead of on DHCP server. We have created multiple VLANs like UGStudent, PGStudent , FacultyStaff and Guest etc. 

1)  We want to bind UG Students Mac in ISE with allowed max 2 devices.

2) We want to bind PG Students Mac in ISE with allowed max 3 devices.

3) We want to bind FacultyStaff Mac in ISE with allowed max 5 devices.

4) And all will be use their AD credentials for signing in  (ie.username and Password)

5) Guest should be allowed only through guest portal.

But MAB is configured with guest portal and assigned max device can be registered is 5. 

So my question is, Is it possible to bind the MAC addresses of respective VLAN with limited no. of devices even though we have max device  reg. limit is 5??? 

if yes, then how we can achieve this with minimum efforts ? 

We also want to use this policy for both dot1x and MAB.

Thanks in advance.

[Nidhi]

You can set the max sessions per user or per group  in ISE from Administration- System-Settings-Max Sessions.

Thanks,

Nidhi

[prashantk]

is it with device MAC binding for respective VLANs ?

[Nidhi]

This is per user or per group. You can limit the concurrent user sessions.  VLAN assignment is part of Authorization policy. 

So you can create policy for different groups in AD and assign different VLAN/ DACLor security group tags. 

Thanks,

Nidhi

[prashantk]

Dear Nidhi,

We achieved this task with dynamic attribute with ISE.
We successfully bind the mac addresses of client devices as per our requirement with some policies and rule configuration on ISE.

ISSUE RESOLVED with Dynamic attribute tied with ISE, without max-session for users or groups.

Thanks for your kind suggestion and time.

thanks & regards,
Prashant

[howon · Accepted solution]

Prashant, good to hear that you found the solution. For others, here is the instruction on how to achieve this:

https://community.cisco.com/t5/security-documents/dynamic-attribute-with-ise-mac-address-matching/ta-p/3643882