About Shaan

Shaan · 03-07-2019

Scenario: I have a MAB policy set where I permit various endpoints with some different profiler policies/logical profiles I’ve defined. Then the last rule is a default deny access. We have a subnet which we allow guests to connect on, and we want the...

Shaan · 03-07-2019

Scenario: I have a MAB policy set where each rule permits a profiler policy/logical profile I’ve defined. Then the last rule is a default deny access. We have a subnet which we allow guests to connect on, and we want them to get permitted regardless ...

Shaan · 05-06-2019

I've been testing this out and I am able to get it working. One caveat I have noticed is that if the MAC address is already in ISE, I have to delete the endpoint first for the new NAS-Identifier attribute to show up in ISE (and thus hit the correct ...

Shaan · 05-06-2019

I tried the 'mab eap' method but am running into an issue. I configured 'mab eap' on the switchport, and in ISE I configured the policy condition to simply match the switch the request is coming from, and then an authorization rule for eap authentic...

Shaan · 05-06-2019

Thanks so much for this info. It would be great if IOS could send the interface description. And VLAN ID/Name is useful too, although unfortunately most of our switches are on 16.x but before 16.12 where this was fixed. I will try out the "mab eap...

Shaan · 04-30-2019

Mike, Interesting idea. In this case it wouldn't work for me though because we also have a bunch of other devices (security cameras, printers, etc.) that are allowed onto the network using profiling and they aren't joined to the domain. Cisco TAC a...

Member Since	‎11-01-2016 09:23 AM
Date Last Visited	‎03-14-2021 12:42 PM
Posts	6

User Statistics

User Activity

Using IP address/subnet as an authorization rule in an ISE policy set?

Adding an ISE rule in an authorization policy set to permit devices based only on IP address (subnet)?

Re: Using IP address/subnet as an authorization rule in an ISE policy set?

Re: Using IP address/subnet as an authorization rule in an ISE policy set?

Re: Using IP address/subnet as an authorization rule in an ISE policy set?

Re: Using IP address/subnet as an authorization rule in an ISE policy set?