ISE - Meraki

[VVVENKAT]

Hi All

I had a look at the ISE - Meraki integration guide How To: Integrate Meraki Networks with ISE

As per the doc, only dVLAN is supported with MS switches. Could you please confirm dACL is not supported with MS switches?

The doc also states that , inline posture node is required. Is it only for MX appliances?

Many Thanks

V.Venkata Manikandan

[Timothy Abbott · Accepted solution]

Hi,

I need to update the doc to remove the references to the inline posture node since 2.X does not support it.  MX still does not support URL-redirect with Session ID and RADIUS CoA.  As a result, it will not be able to participate in the more advanced use cases like posture.  As of now, the MS switch only support dynamic VLAN assignment.  They do not have support for any type of access lists currently.

Regards,

-Tim

[VVVENKAT]

Thanks Tim. I was wondering as ISE 2.x does not support iPEP.

Many Thanks

V.Venkata Manikandan

[umahar]

Tim,

Does Meraki support change of vlan since its an IETF avp ?

If redirection ACL is not supported maybe we can achieve something with a combination of Call Home List and Quarantine Vlan which restricts traffic to internal network via an upstream firewall or even a DACL.

[Jason Kunst · Accepted solution]

Did you look at the Meraki integration guide?
https://community.cisco.com/t5/security-documents/how-to-integrate-meraki-networks-with-ise/ta-p/3618650

[howon]

Which platform is this for? For MR/MS, URL redirect and CoA is supported. For MX, ISE 2.2 & AC4.4 supports posture without relying on URL redirect. However, CoA is required if enforcement is needed on MX platform which I am not sure whether supported or not. I suggest reaching out to Meraki team in regards to CoA support on MX platform.