ISE 2.3.0.298 deny a MAC address authentication

[bo liu]

hi

i have a ISE version is 2.3.0.298

now a device use a wrong password connect network the result is this username locked.

i need ISE deny this MAC.

who can tell me how to config??

[bo liu]

i want config a blacklist in policy before all authencation policy ,but i can't find the identy group in authencation....

[MTOMASSINI]

Hi,

I don't know if there is an advanced feature (except the Blacklist portal on the BYOD side of ISE) to block a user/mac but you can manually deny a MAC address.

You can create an endpoint group called "Blacklisted MAC" and add your mac into this endpoint group. Then you just need to create a policy that will check this Endpoint group and returns a "Deny" if the client mac address matches those in the group.