Limited authorization policy for printers

[BigK]

Expert ! I have a question as I am still learning about ISE. If malicious user is successful in spoofing the MAC address of the printer and gains network access. What can I do to limit access to the network so the the authorization policy for printers will not  provide full network access but still allow the users to print on TCP port 9100/9600 with very limited access to the network.

any examples are appreciated.

Thanks again!

BigK

[Rob Ingram · Accepted solution]

Hi,

When you authorise the printers you could apply a Downloadable ACL (DACL) to the session to restrict access. Example here.

You also have the option to use trustsec to achieve the same, it's more complex to setup and depends on whether your hardware supports it. Example here.

HTH

[BigK]

Thanks! RJI