Hi @IbrahimElbagouri57340,
You are basically talking about 2 different things. One option for you is to do profiling, where you don't really care about MAC addresses and MAB (you could, in order to increase security, but it would be administrative burden), so devices can connect based on profile, something like "If device is HP printer or Lexmark printer then do something". Here you don't specify any MAC address or static endpoint group apart from endpoint profile (which is essentially endpoint group), which is learned dynamically by ISE. By doing profiling, ISE will assign certain MAC address into specific profile group, which is done dynamically. This gives you an option not to care when someone replaces printer, as new printer would probably be same vendor and it will have same profile signature.
Another option, which is more static, is to keep your own groups and input MAC addresses for each device. After that, you can invoke these groups under authorization, and work with them, as per your needs. Problem with this approach is that ig gets hard to maintain it with large environment - imagine you are retail shop, where you have so many different device types (POS terminals, IP cameras, different printers, etc.) and each one is maintained by different or even multiple subcontractors. Each time they need to replace a device, they would need to let you know about new MAC, but also about old one (to do cleanup), and this is slowing them down. Alternatively, if you have such system, ISE can be integrated with CMDB where this type of information can be stored in centralized way, so you wont need to maintain in multiple places.
Either way, you need to configure MAB authentication on ISE. Leaving it with authentication open option would essentially do nothing, as switch will not enforce any authentication.
Kind regards,
Milos
