ISE MAB authtentication with Security Violation

[safwat.ghazy]

i have configured ISE MAB authentication for the customer and he requested that if unauthorized device (his mac address not listed in the MAB list) tried to access the network ISE will configure the interfaces in error-disable or shutdown mode so that even if an authorized device connect back to the port it won't let you until an administrator comes in and re-enables that port that has been shutdown.

please advise if above is possible

[paul]

The best way would be to use an Auto Smartport macro on the switch that shutdown the port and has no "DOWN" trigger setup:

!
! Turn off auto device control, forgetting this could shoot yourself in the foot
!
no macro auto global control device
!
! Turn off the default trigger, forgetting this could shoot yourself in the foot
!
no macro auto global control trigger
macro auto global processing
!
shell trigger ISE-PORT-SHUTDOWN ISE Invoked Macro
macro auto execute ISE-PORT-SHUTDOWN {
if [[ $LINKUP == YES ]]; then
conf t
interface $INTERFACE
shutdown

exit
fi

}

Then in ISE you would assign the ISE-PORT-SHUTDOWN auto smartport result in the authorization profile.