cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

248
Views
0
Helpful
1
Replies
josedunet
Beginner

ISE 1.4 - Device Administration - How doing authorization based on user machine IP address (Specify IP address allow to manage device)

Hi All

I am using ISE 1.4 for device administration authentication & authorization. So know when network administrator want to connect to switch and router for administration, they are authenticate and authorize by ISE Radius.

My question is how to given authorization based on IP address of network administrator machine. Specify in authorization IP address allow to connect to device for administration. I don' know how or where specify it. Someone can help me please ?

Thanks in advance.

1 REPLY 1
Marvin Rhoads
VIP Community Legend

I haven't tried it but you may be able to use the dictionary attribute from RADIUS of "Framed IP address" in a policy element that you call out in your Authentication phase as a prerequisite to the resultant Authorization profile which gives shell access at the appropriate privilege level. 

Here's a handy list of all the RADIUS dictionary elements available to ISE:

https://communities.cisco.com/docs/DOC-67894

Much more common would be to just check the user identity in ISE. That way an authorized administrator can perform their job role no matter what machine they are on (and an unauthorized user cannot usurp the admin role by virtue of being on a certain machine).

Whether or not you do that, you can still restrict the source IP quite simply by using an access-list that you apply to the vty lines. That is perhaps one of the most common ways to restrict what hosts or networks are allowed to access devices in-band.

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars


Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube