Profiling based on MAC Address...

[rezaalikhani]

Hi all;

Consider a scenario where I want to profile an unknown device with MAC Address parameter of the endpoint. In this regard, we have two options, as show below:

As my testing experience, if I choose OUI, I must provide the exact name (not something like OUI STARTWITH AA:AA:AA) of the vendor that has registered the address with IEEE. Right?

Now, if I choose MACAddress, something with MACADDRESS STARTWITH AA:AA:AA is valid for matching policy?

Thanks

[ahollifield]

Why use only MAC address?  Why not also use DHCP or Device Sensor?  MAC address / OUI only is really prone to MAC spoofing attacks and doesn't provide much security.

[MHM Cisco World]

I think he facing host with not correct IP' and he decides to use mac profile.

@rezaalikhani am I correct?

His last post mention that the host show not correct IP' and he accpet solution that there is two vlan.

For me that can be if wrong IP is in different vlan not same one.

If it different vlan (subnet) then there are two vlan one before authz and other after authz.

And the ISE list authz host with IP from vlan before authz.

If both correct and wrong IP in same subnet then there is issue in dhcp profile attribute.

That what I think 

MHM

[rezaalikhani]

Thanks for your reply;

As @hslai said, the NAD correctly submits the IP addresses of the second VLAN using RADIUS Accounting Interim Updates but as the NAD does not send it using RADIUS Authentication Request again, ISE does not show the new IP address in its authentication report...

[MHM Cisco World]

Yes friend that case if we use radius attribute profile not dhcp profile.

Anyway I will make double check and update you.

Thanks alot 

MHM

[rezaalikhani]

I can not use DHCP because the endpoint needs to be assigned static IP address and cannot use Device Sensor because the switch does not support this functionality...

[Karsten Iwen]

If you only want to match the vendor-ID, you don't need to use the Profiler. You can directly use a condition in your authorization policy:

[rezaalikhani]

Thanks for your reply;

Interesting but does not answer my questions...

 Thanks anyway

[rezaalikhani]

Any ideas?

Thanks

[MHM Cisco World]

I have idea 
you can use DHCP profile 
and add static IP to host using it clinet-id or MAC 
here when DHCP assign IP to host it send copy to ISE 
MHM

[hslai]

@rezaalikhani 

Your ideas are correct.

On OUI, take a look at the Cisco Provided Profiler conditions based on it. 

On MAC Addresses, I used your condition with ISE 3.2 and it worked! ISE appears to normalize the MAC addresses to dot-separated and all cap.