Impose ACLs on IoT devices using Cisco ISE

[arunan]

Hi there,

I am new to Cisco ISE. We have hundreds of IoT assets like printers, cameras and VoIP phones in our network. Also, we have permitted ACLs for each asset.

1) Can we use Cisco ISE to impose those ACL rules on assets across the network? If so, how can we do that?

2) Do we have to treat these assets as endpoints or network devices? What is the difference between them?

[balaji.bandi · Accepted solution]

If they can not have supplicant you can to mac-based authentication, based on MAC you can set up what permission or ACL you need to apply.

Most ISE works as below: since you have not mentioned what ISE version here, is this SD-Access deployment?

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/MAB/MAB_Dep_Guide.html

[Rob Ingram · Accepted solution]

@arunan to address your questions.

For the IOT devices, assuming they do not support 802.1X, use MAB. Add the MAC addresses to unique Endpoint Identity Group per IOT device type, potentially combine this with ISE Profiling policies to distinguish between device types.

To apply policies accross the network you can use TrustSec SGTs, these can be applied during authorisation in ISE. The switches can use inline tagging to send transmit those SGTs throughout the network to enforcement point, where traffic can be permitted/denied accordingly.

If you cannot or do not want to implement TrustSec, then you could just use a Downloadable ACL (DACL) to permit/deny traffic on the network.

These IOT devices would be classed as "Endpoints", a network device would be the switches the endpoints connect to.

HTH

[arunan]

Thanks @Rob Ingram & @balaji.bandi . Yes, As you mentioned most of our IoT devices do not support 802.1X. So MAB is a viable option. But I couldn't able to find a guide to configure MAB on Cisco ISE 3.0. Can you advise on this, please?

The part I don't understand is how to map TrustSec SGTs / Downloadable ACL (DACL) to endpoint groups. Can I tag an endpoint using MAB and then assign Trust SGT  DACL to that specific tag?