ACL--- ISE

[minkumar]

Hi Team!!

    in ISE , Can a static acl  be applied dynamically to a switch interface, i.e. if a port on a switch, which is allocated to a printer, becomes active but no certificate is received on the ISE, then the ISE will push an ACL to the switch port to only allow printer traffic.  This could  get around MAC authentication bypass possibly.

Cheers!!

Minakshi

[nspasov]

Hello Minakshi-

You can definitely accomplish this by:

1. Configure the switch to support both mab and dot1x

2. Configure ISE for mab and dot1x

3. Configure a printer specific "dACL" in ISE

4. Configure a printer specific "Authorization Profile" in ISE and attach the dACL created in step #3 to it

5. Test :)

Thank you for rating helpful posts! 

[minkumar]

Hey Neno!!!

  I need to do an  import n export for Mac addresses in Bulk for MAB in ISE. Could you kindly attach the template of .CSV file which can be uploaded in ISE for MAB.

Thanks

Minakshi

[nspasov]

I don't have the template handy with me but you can actually download it directly from ISE :)

Thank you for rating helpful posts!

[minkumar]

Thanks Neno!!!

Appreciate it>>>

[minkumar]

Hi Neno,

  Thsi is not the correct template. I want to upload MAC address information in ISE for MAB.

Are you sure this is the correct template which you have sent?

Minakshi

[minkumar]

Hi Neno,

  I dont seem to find the attachement.

Minakshi

[nspasov]

That is strange because I can see it...let's try for the third time :)

[minkumar]

Hi neno,

  Since I cannot download it. if possible could you please attach the template. There will be an ISE device available in your LAB. Can you download it from there and attach it,

Regards

Minakshi

[nspasov · Accepted solution]

Please find attached.

Thank you for rating helpful posts!

[nspasov]

Sorry about that, it was indeed the incorrect template. Here is the correct one. 

Thank you for rating helpful posts!