Move a Authorization User to isolate VLAN

[quangle1993]

Hi all,

While using ISE, i'm facing needed that disconnect a compliant user or guest user. I found that i can go to Operations > Live Sessions > Show CoA Action to do this. But here is the problem :

If i choose > Terminate Session. User is disconnected but they can get access after a while (Immediately in my case)

If i choose > Terminate Session with port shutdown. The port is shutdown and i can't enable this port from ISE cause RADIUS not support this. If they go to another port they still can access network!

So, is there any way for me to disconnect/isolate a client, they have to meet and ask for approve from me to re-connect to network. And i only need to configure on ISE.

My idea i move that user to profile that have DACL is deny any any, and cause this is user-based so whatever port that user connect, they still in isolated VLAN with deny any any ACL. But i don't know how to do this. Any idea how to configure it on ISE ?

Thanks,

Quang

[Jason Kunst · Accepted solution]

Yes use ISE blacklist feature

https://community.cisco.com/t5/security-analytics-and/how-to-block-a-endpoint-pc-in-cisco-ise-system/td-p/2449185

[quangle1993]

Hi Jason,

Thanks alot, But I can only move Internal User to Black_List. How can I move a AD User to Black list user group ? Or I have to move their MAC to black list endpoint group ?

[Jason Kunst]

The endpoints are blacklisted not the user