User + Mac Address Authorization Policy

Hi,
Is there any option to bind a user who is authorized correctly from external identity with the mac-address of his workstation ?
The point is to give him access to the network only from a specific Workstation and denied him from any other workstation.
Thanks

1. ISE 1.2 is having the role of Radius
2. Really i don't know I guess the binding should be happen before the login as i don't want the user to login from any other PC.
The key point on this scenario is a user to login on the corporate wired network only from his PC (User+MAC) and denied from any other PC.
If you want describe me both ways to understand which might fit in my case.
3. The PC has the native supplicant of Windows and authenticated through PEAP MS CHAPv2
Thanks in advance

Similar Messages

Windows users - mac address book

can windows user see and/or seee and modify the shared MAC address book?
thanks

can windows user see and/or seee and modify the shared MAC address book?
thanks

OIM 11g - User Management Authorization policy issues

Hello,
1) Created an organization -> Human Resource
2) Created an Role -> HR_Admins
3) Assigned HR_Admins roles as administrative role of Human Resource organization
4) Created user1 with organization as Human Resource & Assigned HR_Admins role to this user.
5) Created authorization policy for user management with following selections
Permission -> Create User.
Data Constraints -> Selected "Users that are members of selected Organizations" & selected above Human Resource organization.
Assignment -> HR_Admins role .
now when i log into user1 i am not able to see Administration tab where i can select Create user.
I am working on this issue for couple of days ,but not able to find the solution & have i missed some configurations ?
Thank-You
Rahul Shah

Hi Rahul,
I have tested your scenarion.. with below clause
1) Created an organization -> Human Resource
2) Created an Role -> HR_Admins
3) Assigned HR_Admins roles as administrative role of Human Resource organization
4) Created user1 with organization as Human Resource & Assigned HR_Admins role to this user. : default role All Users
5) Created authorization policy for user management with following selections
Permission -> Create User. :- *"Select ALL"*
Data Constraints -> Selected "Users that are members of selected Organizations" & selected above Human Resource organization.
Assignment -> HR_Admins role .
In data constraints
Organization Security Setting Hierarchy Aware (include all Child Organizations)
Now I am able to see the create user tab and, I can create user in Human Resource org only.
If it doesn't work for you. Just assign "REQUEST ADMINISTRATOR" IN AUTH POLICY. Test the result.
Also what is your OIM version?
Test it with fresh data like new role name, org and user,
-kuldeep
Edited by: Kuldeep on May 22, 2012 4:19 AM

Cisco wlc2504 mac address filtering

I am using a wlc2504 software version 7.4.100.0. I use MAC filtering for wireless device to connect to our wi-fi. Currently I have about 249 saved MAC address that can access the wi-fi. About once a week, the controller looses or forgets 3-5 MAC addresses, thereby devices looses connectivity to wi-fi. Is there a limit to number of MAC address configured to be saved? What is causing this? What can I do to prevent this from happening? Thanks.

MAC Address Filter (MAC Authentication) on WLCs
When you create a MAC address filter on WLCs, users are granted or denied access to the WLAN network based on the MAC address of the client they use.
There are two types of MAC authentication that are supported on WLCs:
Local MAC authentication
MAC authentication using a RADIUS server
With local MAC authentication, user MAC addresses are stored in a database on the WLC. When a user tries to access the WLAN that is configured for MAC filtering, the client MAC address is validated against the local database on the WLC, and the client is granted access to the WLAN if the authentication is successful.
By default, the WLC local database supports up to 512 user entries.
The local user database is limited to a maximum of 2048 entries. The local database stores entries for these items:
Local management users, which includes lobby ambassadors
Local network users, which includes guest users
MAC filter entries
Exclusion list entries
Access point authorization list entries
Together, all of these types of users cannot exceed the configured database size.
In order to increase the local database, use this command from the CLI:
<Cisco Controller>config database size ?
<count> Enter the maximum number of entries (512-2048)
http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/91901-mac-filters-wlcs-config.html

How to capture System MAC address On internet

Hi,
I am doing internet based application. I want to capture user system MAC address when ever user is logged in to my application over internet. So please tell me how i can capture users mac address. please help me.. with out this i cant i go further in my process. please help
Regards,,

I think you're out of luck--the IP packets that come to your web server don't contain the MAC address; that would only be available on the LAN where the NIC resided. All the other components of the Internet don't use the MAC address (that's actually what the "Inter" part means).
I assume you're wanting to track unique users. You might try cookies or something of the like.
Best of luck.
John

Replication of Mac-Address in HA WLC 5508

Hi,
we have two 5508 WLC and they are in HA,
1)just wanted to know whenever i add new user mac address to the Primary WLC, then how it will replicate to Secondary WLC.
1)if BOX TO BOX connectivity is not there ( other is connected to LAN) Then how we can achieve HA.

Hi Sudhir,
In Box to Box connection: Controllers have a dedicated HA(Redundency) port, which is used to synchronize configuration between controllers in the Active and Standby states.
The redundancy port is used for configuration, operational data synchronization, and role negotiation between the primary and secondary controllers.
Bulk configuration during boot up and incremental configuration are synched from the Active WLC to the Standby WLC using the Redundant Port.
Hope it helps.
Regards
Dont forget to rate helpful posts

WLC - How to block a single client MAC address?

Hi Sir,
On a WLC (software version 4.1.185.0), how to block a single client MAC address?
I thought of using the SECURITY -> Disabled Clients. Is it right?
There are currently 250 users connected to the WLC. MAC Filtering is not a scalable solution because as I understand it, we have to specify all the legitimate MAC addresses in the local database.
Thank you.
B.Rgds,
Lim TS

Hi Lim,
As you have discovered, the Mac filtering on the WLC is an Allow (based on Mac address) rather than what you need which is a Deny (based on Mac address). I have not tried this feature but I think you are on the right track in using the Exclusion List (Blacklist) feature. Have a look;
Use SECURITY > AAA > Disabled Client then click New or MONITOR > Clients then click Disable to navigate to this page.
This page allows you to manually Exclusion List (blacklist) a client by MAC address.
Add the MAC Address and an optional Client Description for the client to be disabled.
Note When you enter a client MAC address to be disabled, the Operating System checks that the MAC address is not one of the known Local Net clients ( Local Net Users), Authorized clients ( MAC Filtering), or Local Management users ( Local Management Users) MAC addresses. If the entered MAC address is on one of these three lists, the Operating System does not allow the MAC address to be manually disabled.
Hope this helps! Let us know.
Rob

How to Implementing ise 1.2 authentication user name against mac address

Hi all,
My organization wants to authenticate medical devices with certificate.
What I'm trying to do is on the certificate the name of the user will be his mac address,
And the ise policy will be if the user name equal to mac address than he authenticate.
Until now I didn’t succeed.
Is it possible?
Lee.

It sounds like you are trying to do two different things.
The certificate can be done through 802.1x using peap I dont know if your devices can handle dot1x so if not they can use MAB. Far less secure but if its a low level device like a printer that has limited input capability then you are stuck with MAB.
What you could do with MAB is use the OUI and some other identifying information (if available) like device host names (This can be derived from DHCP i believe) and possibly av pairs (RADIUS) to help profile the devices. These can be put into a custom endpoint profile that is given a specific authorization rule.
The whole point is to try to isolate certain types of equipment so that only they get the custom authz rule
Does this make sense? Im shooting a little blind here without more info.

Mac-Address Different format for Authorization on Cisco ISE

Dear All,
I have problem with my Cisco ISE,
This is the design :
ISE ---- Core Switch ---- 3Com Switch --- PC User
My Case:
Authorization is based on Mac-address and Active Directory,
But user with PC that connect to 3Com swtich is Deny by ISE because the Format Mac-address is different with Cisco,
Mac-address Cisco format : XX:XX:XX:XX:XX:XX
Mac-address 3Com format : XXXX-XXXX-XXXX
3Com Switch type is TRICOM 4210 26-PORT.
Anyone have experience with this? and how change the mac-address format in 3Com so user can authorized by Cisco ISE.
note:
authorization based on Active Directory is not problem with 3Com Switch.
Based on my experience, Different product is different format mac-address, so this case not only for 3Com Switch.
Thanks,
Arika Wahyono

I do not think Cisco will add these vendors to the supported switch matrix because then it would be a support issue that cisco would have to deal with, much like most of the AD issues I experienced when I worked in TAC. Your best bet would be to run the evaluation license instance in a lab and have a 3com switch point against that.
Other than that I do not recommend upgrading to 1.2 without validating that the new "multi-vendor" MAB support will work on your switch.
PS- Keep in mind that my comments is just my opinion so you may need to open a TAC case for an official answer.
Tarik Admani
*Please rate helpful posts*

MAB user failed to land correct Authorization policy after posture success

Hi,
We have MAB user who authenticates via webportal using domain username/password and get the NAC web agent download and do the posture.
After posture is complated (say success/passed), the user is landing on Defaul Policy which is DenyAccess.
I have change the gestportal setting with enabling Vlan DHCP Release and CoA, but there is no luck. I have similar rules for wired dot1x and its working fine after posture part, only different is they are MAB users and authenticated via webportal and belongs to different user group in AD.
What we could see on the switch, once you authenticated, it get the Web Redirect and when the user authenticates in get the NAC web agent direct and after posture completed it again go back to Web portal redirection and giving error saying both dot1x and MAB failed,
Attached is the switch logs and ISE configuration and failed logs.
If someone has clue on this or has come across this issue, please update me.
Thanks in advance.

Instead of using the Wired_MAB prefix in your first three authorisation rules, refer to the Endpoint Identity Group instead. The reason you get Deny Access is because the event you're looking for isn't a MAC Auth event, and therefore those rules get skipped. Using the Endpoint Identity Group will allow you to evaluate the MAC Address and will get your rules working as required.
Sent from Cisco Technical Support iPad App

Should I use a MAC address to validate users for my program?

I'm writing a graphical console program and I was planning on using a few methods for security. One being to block a user from logging in again if they don't type the correct username and password within three tries until the root user authenticates it again. I was planning on blocking the IP address but someone suggested blocking the MAC address since no 2 have the same ID and it's burned in, not to mention alot of people have dynamic addresses. However, I was reading that MAC addresses are mainly used in ethernet cards. I thought any device that has network capabilities has to have a MAC address? Is it good to use a MAC address for blocking someone from logging in again or what?

Its very easy to change your MAC address. If you have a wireless router (which you can buy for like 20 dollars) then you can tell it what MAC address to use. So I agree, don't use a MAC address to block users from your program. Also are you sending the username/password over the network in clear text? If so, these can be intercepted. So doing that may be a bad idea; it depends on how much security you want for your application.

Can I get the Mac address in Audit logs of Active directory server for the user's machine which connect to the network/Domain

Hello All,
I am trying to get the information of all the user's who connect to our Domain network by signing in using the domain account. For this I am using the Windows audit group policies ( I am not sure of there is any other way). I can see when the user tries
to login to the network there is a audit event created on the AD/DC server. I can see the Kerberos authentication and logon/logoff events in the audit events under event viewer.
However the info which is being populated in these events include :- Hostname, IP address, Username and so on... But I can't see the MAC address of the user machine/system. Is there any way I can
get the Mac address of the endpoint system as its one of the important criteria for our project.
Any inputs on this would be appreciated, incase if there is any other way other than group policies please suggest.
Thanks,
Kavish

> include :- Hostname, IP address, Username and so on... But I can't see
> the MAC address of the user machine/system. Is there any way I can get
> the Mac address of the endpoint system as its one of the important
> criteria for our project.
If you use DHCP, you can query the DHCP server. There's no builtin
method to get the MAC address directly.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Authorization Policy for Modify user in OIM 11gR2

Hi Experts,
Requirement: I want the users in particular org not to modify certain user attributes and users from other org should be allowed to modify user.
I have created user1 whose organization is org1 and role is role1. I have also created user user2 under same org and same role. I assigned the Admin Role "User Administrator" role to user2.
So If user2 from same org1 tries to modify certain attributes then OIM should throw error message. I have completed till this.
But when the user from diff org say org2 with Admin Role "User Administrator" tries to modify user, OIM is not allowing to modify user which should not be the case.
I want the Auth Policy to trigger only for Org1. I have specified the below condition for my custom policy in OES admin console but it is not triggering.
The condition is
IF ( OrclOIMTargetEntity = 'true' AND OrclOIMUserOrganizations = 'true' AND STRING_AT_LEAST_ONE_MEMBER_OF(OrclOIMUserOrganizations,['25','1000000']) = true )
What am I missing?
Any help is much appreciated.

Hi
Can anyone let me know the steps to restrict modify user operation for the users belonging to specific organization in OIM 11gR2. The condition which I specified under Authorization Policy in APM console is not triggering at all.
Thanks!

Authorization Policy for only search users

Hi all,
I need create a custom authorization policy for only search all users in create request. The users can't see any profile information of others users.
Anyone can help me ?
Regards,
Joel

ViewUser Admin Role can search and view users by default. Since the OES policies for this admin role has action as ViewSearch Entity. In your case, you can write EL's to hide Admin tab which will hide Admin ltab links based on current logged-in user profile.
http://docs.oracle.com/cd/E27559_01/dev.1112/e27150/uicust.htm#BABHBFGH

Problems with Authorization Policy, the USER has expired and the ISE is allowing access.

Hi,
My end customer reported an issue with ISE 1.1.4-218.
The GUEST user is expired but still can authenticate in the WLAN.
That's an known issue/bug?
Thanks!
Regards,
Rafael Eloi

Check if the option in the configuration part of the Authentication process = CONTINUE.
For example, when you use CWA, the IF AUTHENTICATION FAILED Option = CONTINUE so the MAB Auth always fails but based on that Option your connection continues so you are actually redirected using the AUTHORIZATION Policy.

User + Mac Address Authorization Policy

Similar Messages

Maybe you are looking for