ISE - Deploy Internet Access Wired GUEST

[Kalimoz]

Hello all,

Im having a huge struggle to deploy the cenario i want in ISE.

So i have dot1x and MAB working fine, the problem is when i want someone from outside the company plugs the cable (even if they don't belong to AD and not having the MAC associated with ISE) have access only to internet.

I'm not able to do this in ISE. Is it possible?

PC(outside company) -----> PLUGS CABLE -------> ISE ------> Give him VLAN (example 20) only internet access -----> Happy PC

Is it possible?

[Marius Gunnerud]

Of course this is possible and it is also a good practice.  How are you currently classifying your company devices using dot1x and or MAB?

If you have dot1x and MAB setup correctly, you only need to configure a catch all rule that sends a dACL that only allows internet access to the switch port

[Kalimoz]

Hello Marius,

Thank you for the reply.

The condition i have for the dot1x is based on Location and Equipment, this is the same for MAB

For dot1x Pcs company need to validate de certificafe and user based on AD

For MAB is only based on MAC imported to the list (Like Printers / Cameras etc) each one with their respective profile.

So what i can interper in what you say is like create an Authorization policy based on Location or Devices and use like VLAN 20 and dACL on it?

[Marius Gunnerud · Accepted solution]

Yes, or if you have an unused VLAN, remediation VLAN for example that only has access to internet, you could push the devices into that VLAN.  If you do not have a remediation VLAN then a dACL will do the trick.  I find that many do not have a VLAN for unauthorized devices already configured which is why I recommended the dACL approach. 

[Kalimoz]

Thank you Marius,

Will try that approach