cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6690
Views
11
Helpful
8
Replies

ISE and MAB for printers

Ilnur.Garipov
Level 1
Level 1

Hi, everyone!

Has anyone set up MAB for ise-2.3 for printers, having a list of the mac-addresses of these printers?

Please tell me how to do it.

Thanks!

1 Accepted Solution

Accepted Solutions

There is a precreated condition for non-cisco phones

View solution in original post

8 Replies 8

What are you looking for exactly?

There are domain PCs, IP telephones and printers in my network. So, I know how to set up dot1x for domain PCs, but I don’t know how to configure MAB for printers and ip telephones so that domain users can print and make calls.

that's pretty straight forward. Enable 'mab' under the interfaces. Then in
ISE configure authorization policy to match Wired_MAB _ Cisco IP Phones and
grant it access in the result.

For printers you have two options:

1. Let them connect for 1st time get profiled and if you use standard
vendor then you can add authorization policy to match the vendor profile
and allow acess
2. Option 2 is to create end point identity group and add the mac addresses
statically to it. Then create authorization policy to match this group and
grant access

Thank you for your advice! 

If I have non-cisco phone the second option will be work for this devices?

There is a precreated condition for non-cisco phones

I have a doubt here.

 

Is there any other options available to do authorization of printer which don't have any domain credentials ? other than mab and profile attributes ? combination of mab + serial number + and other for authorization ?

Is it possible to do a posture assessment for printer to check the firmware version ?

Is it possible to do a posture assessment for machine which running with AIX operating system ?

 

Hi

I have a question to do the second option, it's only necessary to have an Essential License for each device?

Regards, 

Fabian Iza

Arne Bier
VIP
VIP

“Posture assessment” on printers would not be the same as posture assessment on operating systems such as Windows/Mac etc because we cannot execute code on those devices. But you can profile a printer and I think SNMP might provide the answer. Profiled authorisations will consume 1 Advantage license.