Registering BYOD device on wireless then connecting to wired

[Madura Malwatte]

ISE 2.3 patch 5

I have byod wireless working well for mac and windows machines. However I need to be able to connect these byod registered devices to wired dot1x port after they have been registered. However this does not work, because when the device is registered via wireless, its only the wireless mac address that gets added as byod registered and also into the registered device group. When it is connected to wired dot1x port, ISE has no idea about the ethernet adapter mac address and doesn't know it already been registered for byod.

I am trying to avoid having users go through the byod process a second time just for the wired adapter. Is there a better way to let ISE know that once the device is connected to a wired port to check whether it has already been registered via wireless?

The only thing I can think of is to go to mydevices portal, add the ethernet adapter mac address and then also manually add the mac to byod registered device group which we are using as a condition in client provisioning policy.

How is everyone else doing it? I want to be able to register byod devices once via wireless, then be able to use these registered devices on both wireless and wired.

[Francesco Molino]

Hi

Usually we need users to enroll once in wireless and once on wired.
Adding the mac address manually means users have to check their mac addresses and add it to mydevice portal which isn't the greatest solution.

These are BYOD devices which means you aren't controlling them in any ways to apply some scripts or whatever. The only proper solution would be to get them onboarded a second time over the wired infrastructure.

[ldanny · Accepted solution]

This topic has come up and in being researched internally

https://community.cisco.com/t5/identity-services-engine-ise/onboard-endpoint-using-api-to-then-manage-via-mydevice-portal/td-p/3825148

[Jason Kunst]

I am testing this with 2.4 and seeing that the MAC address on windows machine is populated for the wired NIC (built-in) as well. 2.4 is our current recommended long term release.https://community.cisco.com/t5/security-blogs/announcing-the-quot-suggested-release-quot-status-of-ise-2-4/ba-p/3775587

If this is for a NIC not yet connected (in a docking station) then it would be advisable to have the user connect to wired/wireless when onboarding. Otherwise we have no visibility into those mac addresses.

[Madura Malwatte]

Hi Jason, do you know if this is the same behaviour for 2.3? I will test on 2.3 with the wired port connected and enabled to see if it picks up both wireless and wired mac. 

[Jason Kunst]

I don’t know when it changed . I am seeing on 2.4. Unfortunately I don’t work with the older releases