ISE Identity Services Engine authentication method

[zain-3-4]

Dear Team, 

Just want to confirm, we created SSID and we're using ISE as a NAC right now we would like to implement double authentication method MAC address, and Active Directory credentials Network team mentioned it is not supportable to implement both of them together just would like to confirm if we can or cannot.    

[Rob Ingram]

@zain-3-4 Typically you would not bother with doing a MAC lookup and AD authentication, as you would have to manually update the MAC group membership and MAC addresses can easily be spoofed.

You could group the MAC addresses in ISE. In the authorisation rule in the Policy, define the MAC identity group and the AD group. So both, the MAC address and AD group membership must be matched.

[zain-3-4]

This is what i am trying to implement with Network team to enable both of them but they said not applicable that is why i need to know the details to implement it. 

[Rob Ingram]

@zain-3-4 create the Endpoint Identity Group, add the MAC addresses. Edit your authorisation rule and add a condition "IdentityGroup:Name EQUALS GROUPNAME" and  ExternalGroup EQUALS DOMAINNAME/OU/Group

[PSM]

@zain-3-4 It may be communication gap between teams. what @Rob Ingram is mentioning there is not role of MAC addresses during authentication, but you can use MAC address to authorize after authentication has been successful.

1. On wireless controller SSID configuration, enable only dot1x authentication. You can't enable MAB along with dot1x authentication( mixing of two L2 auth method not suppoerted)

2. In ISE you will authenticate against active directory.

3. In authorization you can add a condition for device MAC must be in specific group. MAC address must be added in group for this.

[zain-3-4]

Dear @PSM , 

I will forward it to Network team to check it and let you know. 

Thank you @PSM @Rob Ingram