Mac-Filtering on ISE

[Mady]

Hi,

I created internal endpoint groups which I manually add the MAC address of user's device. The AuthZ policy I created is EndpointGroupA and SSID-GroupA = permit access. 

I also have CWA portal, users who register to that portal will tag their endpoint as RegisteredDevice.

My challenge is when user with MAC addess A (example only) that  is manually added to EndpointGroupA registers to CWA portal its MAC address A is now tag as RegisteredDevice.

So whenever this MAC address A access the SSID-GroupA which requires MAC-filtered device - it cannot connect to that SSID.

Hope you can help me on this. I'm thinking if there is other attribute for MAC filtering that I can use on the policy. Or any additional policy that I can configure.

Thanks in advance!

[ajc]

Try the attached authorization policies for CWA after the following ones:

1-if EndpointGroupA and SSID-GroupA then permit access (manual endpoint entries would get access)

2-if Network Access:UseCase EQUALS Guest Flow then permit access

***********THE ATTACHED POLICIES WOULD GO HERE*********

(the NOT EQUALS can be replaced by NOT CONTAINS

[Mady]

thanks for your reply. I will try your suggestion. I would like to ask if is it possible to assign endpoint to two different endpoint groups for example? Because I used hotspot, self-registered and BYOD and each has different endpoint group.

there's a chance that the mac filtered endpoint connects to all of that portal and it will be tag to different group.

[ajc]

no, you cannot assign an endpoint to different endpoint groups. You would have to play with the authz policies AND the Endpoint Group from the portal (see below).

[Mady]

:) thanks! it seems that I really need to work on my AuthZ policy. I will definitely try your recommendation.

[ajc]

do not forget to rate, thanks

[ajc]

BTW, MAB authentication is not safe (spoofing can happen) unless you are ONLY allowing internet access to anyone connected to your SSIDGroupA.

[Mady]

Yes, it has access to internet only. :)