I have a large customer looking to leverage dynamic variables on their endpoints to lock certain endpoints into a particular department (serviced by a set of IDF), certain switches and potentially a certain port on a switch. I can do all this easily using dynamic variable matching, but the customer asked how does this scale. Do we have any data on dynamic variable performance? The majority of the matches would use the Contains logic, but I do have one doing a MATCHES (Regex).
As an example I use the version under the network device to tag it with departments serviced by that switch "HR-Legal-IT-Any". Then on the endpoint I add 3 custom attributes:
Then my rules simply says:
Device:Version Contains Endpoint:Department Code
Network Access:Network Device Name Matches Endpoint:Switch
RADIUS:NAS-Port-ID Contains Endpoint:Port
So under the endpoint I can set the 3 attributes to say:
That would allow the device to connect to any switch coded for HR on any port.
I can set another endpoint like this:
To lock the device into the IDF-1 switch on port 1/0/1.