ISE device profiling and mac address spoofing test

[BrianPersaud]

Hi All

I setup ISE profiling for Cisco IP phones and it works as expected.  I changed the certainty factor for Cisco-IP-Phone to a higher number to ensure that it would match on multiple criteria before allowing the IP phone.  

From what I see, if I disconnect and reconnect the IP phone, ISE does not do a full profiling for the second attempt.  Instead it checks the mac address and recognized that it is already profiled as a Cisco IP phone and allows it. This is a security issue because if I spoof the IP phone's mac address on a laptop for example, I will gain access to the network.

I verified this by setting up a laptop with the same mac address as the IP phone.  The laptop was successfully authorized using the same authorization policy that the phone used.  

Is this expected behavior or am I missing some configuration steps?

ISE 2.4 Patch 9

IOS 16.6.6

Thanks

Brian

[Mike.Cifelli · Accepted solution]

Something you may want to consider is configuring anomalous endpoint detection. Essentially this would aide in deterring such a scenario. A change in profile would trigger and you could quarantine via CoA. From doc:
Once detection is enabled, ISE monitors any new information received for existing endpoints and checks if these attributes have changed:
Endpoint Policy - A change in endpoint profile from Printer or IP phone to Workstation.
Just note that I am pretty sure you cannot tweak what attributes it monitors. Good luck & HTH!
See here for my detail: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/200973-configure-anomalous-endpoint-detection-a.html

[BrianPersaud]

Thanks I am in the process of testing to see how it works.

[BrianPersaud]

I retested after enabling Enable Anomalous Behaviour Detection and Enable Anomalous Behaviour Enforcement along with the appropriate authorization policy.  I set the laptop to use the mac address as the IP phone.  It worked as expected to deny the laptop from accessing the network.