ISE rule match IP-Address

[Sebastian Helmer]

Hi,

I try to enable security on location without firewall. So my idea was to use the ISE to match on IPs and push an DACL to that switch.

I'm pretty new in ISE and don't see an idea to match on Client IPs in the condition area.

any hint?

best regards,
Sebastian

[Seb Rupik]

Hi there,

TrustSec is the technology that will allow you to achieve this. It is a big subject, but this document should lead you to some working configuration:

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116497-configure-trustsec-00.html

cheers,

Seb.

[nspasov]

I don't believe this is possible. Can't you instead place the NADs (in this case switches) in specific location based groups/containers and then build the policies/dacls based on that?

Thank you for rating helpful posts!

[Justin bollinger]

As the others have stated there is probably a better way to do this, but you should be able to use the Radius:Framed-IP-Address attribute in a AuthZ condition.  

There may be some caveats where this doesnt work well like MAB, but for regular dot1x the supplicant should provide this field.