Switch location based DACL

[harrzhan]

Hi experts

With the variable in ISE 2.4, I can tie a name of a DACL to an attribute of an endpoint. Is there a way to tie the name of the DACL to the NAD switch location? 

The goal is to implement a location based DACL. There are near 200 sites, and the DACL limit the traffic to a local site only. The easiest way to find out where the endpoint is is to use the connected switch location.

In stead of using device.location as a condition for these 200 sites, I would rather use a DACL name = Device.location in the authorization profile.

Do you have any recommendation?

[paul]

I haven't tested this out, but I have done something similar using a local ACL on the switches at each location.  The switches would have a local ACL called "Local_Access_Only" that is customized for the location and ISE would apply the ACL to the session.  So I am not applying a DACL, but applying an ACL that is on the switch.  

[harrzhan]

Thanks for the answer. However, the number of switches is too big to make it manageable. Adding one additional line, I would have to go to all the swtiches.

[paul]

That can all be automated assuming you are managing the switches with any modern management software.