cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
772
Views
0
Helpful
1
Replies

ISE authorization policy question

Cole Courtney
Level 1
Level 1

I'm in the process of finishing up my authorization policy and was hoping to get some input on how to deal with freshly imaged machines.  The current authorization policy relies on Active Directory (peap-tls) and CCM (eap-tls).  Since the newly imaged machines will not be part of the domain yet they'll fail and will either be completely denied access or they'll be dropped into a null vlan. 

Would it be viable to create a policy that says if your name starts with the first 5 characters of our naming convention then you can be dumped onto the internal data VLAN and couple that with a DACL permitting access to ports necessary to join the domain? 

I'm not sure what type of security implications this would have?

If this is not a suitable route what would be a best practice approach?                  

1 Reply 1

Saurav Lodh
Level 7
Level 7

You can do the later one if they fail authenticaton , they be granted separated Vlan with some defined access.