ISE and MAB for printers

[Ilnur.Garipov]

Hi, everyone!

Has anyone set up MAB for ise-2.3 for printers, having a list of the mac-addresses of these printers?

Please tell me how to do it.

Thanks!

[Mohammed al Baqari]

What are you looking for exactly?

[Ilnur.Garipov]

There are domain PCs, IP telephones and printers in my network. So, I know how to set up dot1x for domain PCs, but I don’t know how to configure MAB for printers and ip telephones so that domain users can print and make calls.

[Mohammed al Baqari]

that's pretty straight forward. Enable 'mab' under the interfaces. Then in
ISE configure authorization policy to match Wired_MAB _ Cisco IP Phones and
grant it access in the result.

For printers you have two options:

1. Let them connect for 1st time get profiled and if you use standard
vendor then you can add authorization policy to match the vendor profile
and allow acess
2. Option 2 is to create end point identity group and add the mac addresses
statically to it. Then create authorization policy to match this group and
grant access

[Ilnur.Garipov]

Thank you for your advice! 

If I have non-cisco phone the second option will be work for this devices?

[Mohammed al Baqari · Accepted solution]

There is a precreated condition for non-cisco phones

[johnywalker]

I have a doubt here.

Is there any other options available to do authorization of printer which don't have any domain credentials ? other than mab and profile attributes ? combination of mab + serial number + and other for authorization ?

Is it possible to do a posture assessment for printer to check the firmware version ?

Is it possible to do a posture assessment for machine which running with AIX operating system ?

[fiza258]

Hi

I have a question to do the second option, it's only necessary to have an Essential License for each device?

Regards, 

Fabian Iza

[Arne Bier]

“Posture assessment” on printers would not be the same as posture assessment on operating systems such as Windows/Mac etc because we cannot execute code on those devices. But you can profile a printer and I think SNMP might provide the answer. Profiled authorisations will consume 1 Advantage license.