Rewrite calling-station-id for authorization policy

[jpujol]

Hi,

I have a customer who wants to verify the MAC address written in a machine certificate (CN attribute), but the certificate wasn't deployed through ISE, and the MAC address in the certificate doesn't have the format expected by ISE (from the calling-station-id).

Is there a way to rewrite the calling-station-id or the cert attribute in any way ? I don't see any alternative in the documentation but applying a strict = comparison.

Thanks,

jean-francois

[hslai · Accepted solution]

When Radius:Calling-Station-ID in the left hand side of the condition, there will be an option to treat the field as MAC address so that the comparison is normalized. This is supported since ISE 1.2 by CSCtz41262