ISE- Low Impact Mode with Non-Domain Devices

[hadeermohamedfcis1042391]

I tried to apply low impact mode on wired non-domain devices but connected to my network how to authenticate them?

And if I apply the ACL on the switch on these devices is it enough or not?

[Greg Gibbs · Accepted solution]

This question is quite broad and general, but if the endpoint does not support 802.1x you would typically have a MAB 'fall-through' authentication policy (Internal Endpoints with the 'If user not found = CONTINUE' option).

You would then have an authorisation policy that uses either Profiling conditions or statically assign the MAC addresses to an Endpoint Identity Group and use that as a matching condition.

See the Secure Wired Access Prescriptive Deployment Guide for more information.