How to apply ACLs to a device using Cisco ISE

[blackbird_bb]

Hi there,

We have a set of policies (ACL) to be applied on inbound and outbound traffic for a set of devices (known by IP / MAC addresses) in a network.

1. Is there a way to impose ACLs on individual devices using Cisco ISE?
2. If so, does Cisco ISE expose any APIs to perform this task?

[Rob Ingram]

@blackbird_bb Yes there are several different ways, what make/model of devices are you referring to?

You can apply Downloadable ACL (DACLs) to the access layer switches the endpoint are connected to.

You can also use TrustSec SGACL to deploy policy to the access layer or distribution layer enforcement points.

[blackbird_bb]

Thanks, @Rob Ingram. As per my understanding, Downloadable ACLs can be applied to an access layer switch port inbound traffic only. In other words, dACLs allows us to create a policy for only outgoing traffic from a device. it doesn’t allow us to create an ACE to apply for incoming traffic to a device.

For example, to deny any incoming traffic coming from subnet 10.10.1.0/24 to the device, I used the following ACE 

deny udp 10.10.1.0 0.0.0.255 any eq 1024

But ISE doesn’t accept this ACE because the source must be ‘Any’ in dACL.

Is there any method to overcome this limitation and apply policies in both directions traffic of a device?

[Rob Ingram]

@blackbird_bb perhaps use @MHM Cisco World suggestion, with a filter-id ACL. This is an ACL that is defined on a switch and ISE just delivers an ACL name via RADIUS, this attribute can also be used with non-cisco switches

[MHM Cisco World]

There are two choice

1- per user acl 

Acl is push from ise toward the sw 

2- filter-id 

Acl is found in sw and ise push it name to sw.

So yes ise can do this.

[MHM Cisco World]

per-user ACL with any 
SW use ip tracking to re-arrange the ACL to add instead of any to host IP.

[imanv]

Hello.

---

@blackbird_bb wrote:

1. Is there a way to impose ACLs on individual devices using Cisco ISE?

---

Yes. There is two way to impose ACLs. The ACLs can be stored on ISE known as dACL or the ACLs stored on your switches (Authenticator in 802.1x architecture) You should create the ACLs here.

Then you bind it to a Authentication Profile and call this profile when creating the polices.

As you can see, if you want to use dACL, the set your dACL name here. If you prefer ACLs stored on switch, then just put the ACL name at ACL filed. Note that this filed is case sensitive.