CISCO ISE Authetication wirelss request with both username and mac address in one rule

[mortezasadeghi]

Can anyone guide me about how to request authentication of wireless Access with a user name and the MAC Address at the same time.

To prevent the number of device who can connect to the network

[nspasov]

Hi there! Quick question: Are you using Cisco Wireless? If yes, you can configure the SSID to perform 802.1x (EAP-PEAP, EAP-TLS, etc) + MAC Filtering. Then in ISE you can configure it to check for both the EAP credentials and the MAC address. However, the issue here is that you have to manually manage mac addresses which can be very time consuming. 

I would recommend that you instead push users through a Web Portal in ISE. Then restrict the maximum number of devices through the Web Portal settings in ISE directly. That way the configuration on the WLC would be simple and you won't have to manually manage mac addresses. 

I hope this helps!

Thank you for rating helpful posts!

[mortezasadeghi]

Hi Neno Spasov

Thanks for Reply

i know, but you can not enable the other layer 2 security except (psk) when the mac filter enable.

[nspasov]

I thought this feature was introduced with version 8.3 of the WLC but I could be wrong. I am away on vacation right now so I cannot test/confirm it. 

In either case, I would suggest you try my 2nd suggestion (Web Auth) vs manually controlling mac addresses. 

Thank you for rating helpful posts!

[mortezasadeghi]

thank you so much

i found the the solution and it's been working with user pass method either Mac binding together .

[nspasov]

Great! Glad to hear that you were able to solve your problem! Can you give us a few more details around what was the exact solution and configuration steps required?

Thank you for rating helpful posts!

[sajid_m123]

Could you please elaborate on user pass method?

[mortezasadeghi]

Hi all

the solution is

you should create 2 access rule first one for authenticate the mac address match the local database and second rule authenticate the username and password.!

I test it and work correctly.