ISE 2.6 where to put mac addresses

[as00001111]

Hi guys,

right now we are using ACS 5.8 for dot1x and mab.

I want to replace acs with ise 2.6

in acs -> Users and Identity Stores -> Internal Identity Stores -> Users are all mac addresses for mab. all mac addresses are manually added.

Where can I add those mac addresses in ISE?

Thank you!

[Mike.Cifelli · Accepted solution]

In ISE you manage internal endpoint identity groups here: Administration->Identity Management->Groups->Endpoint Identity Groups. You also have the ability to rely on adding them via REST APIs or via context visibility->endpoints (add). HTH!

[Mike.Cifelli]

Here is a quick script you can use for new endpoint bulk adds.  Note that this script will not work for existing MACs in ISE db, you will need to identify your unique group id and update url and user/pass info:

#!/usr/bin/python
import requests
import warnings

#ignore invalid cert warnings
warnings.filterwarnings("ignore")

maclist = open('MAC.txt','r')
address = maclist.readlines()

for mac in address:
    API_DEVICE = "https://<your ise pan>:9060/ers/config/endpoint/"
    API_ERS_USER = "<user>","<password>"
    API_DATA = ({
        "ERSEndPoint" : {
        "name" : "Workstation",
        "mac" : mac,
        "staticGroupAssignment" : "true",
        "groupId" : "a1649530-6840-11e9-aa97-0242f38bcc8a",
        }
    }
)
    r = requests.post(url=API_DEVICE, auth=API_ERS_USER, verify=True, json=API_DATA)
    print r.reason   

Finding unique group ip:

$ curl -k --include --header 'Content-Type:application/json' --header 'Accept: application/json' --user <user>:<pass> --request GET https://<ise pan ip>:9060/ers/config/endpointgroup?filter=name.EQ.<your endpoint group name>

Response will look like:

{
    "SearchResult" : {
        "total" : 1,
        "resources" : [ {
            "id" : "a1649530-6840-11e9-aa97-0242f38bcc8a",
            "name" : "<your group id>",
            "description" : "xxxx",
            "link" : {
                "rel" : "self",
                "href" : "https://<ise pan ip>:9060/ers/config/endpointgroup/a1649530-6840-11e9-aa97-0242f38bcc8a",
                "type" : "application/json"
            }
        } ]
    }
}

 HTH & Good luck!

[as00001111]

Hi!

I had an ISE training 6 months ago and the instructor told us that adding mac addresses is not that easy.

First of all, a new device must be connected to the network in order to appear in the endpoint visibility context.

After that, you can add the mac address since ISE knows it.

But I'm looking for a possibility to add mac addresses beforehand. manually. Is that possible?

[thomas · Accepted solution]

Your instructor was wrong.

You can add them under the Context Visibility > Endpoints menu as many people have said.

Use the + :

or CSV Import option:

Use the attached CSV file as an example if you like.

When you add them manually, you simply will not have any IP address or authentication information for them (yet):

[Surendra]

You can add them under Context Visibility > Endpoints.

[as00001111]

Hi!

I had an ISE training 6 months ago and the instructor told us that adding mac addresses is not that easy.

First of all, a new device must be connected to the network in order to appear in the endpoint visibility context.

After that, you can add the mac address since ISE knows it.

But I'm looking for a possibility to add mac addresses beforehand. manually. Is that possible?

[as00001111]

Hi!

I had an ISE training 6 months ago and the instructor told us that adding mac addresses is not that easy.

First of all, a new device must be connected to the network in order to appear in the endpoint visibility context.

After that, you can add the mac address since ISE knows it.

But I'm looking for a possibility to add mac addresses beforehand. manually. Is that possible?

[Mike.Cifelli]

But I'm looking for a possibility to add mac addresses beforehand. manually. Is that possible?
-As three of us have mentioned, Yes absolutely. When adding new endpoints I personally prefer the rest api way. However, there are easier ways. Both of which include the bulk csv @paul mentioned and then the manual one-by-one way under context visibility.  There you can add the MACs and statically assign them to groups and/or a specific profile policy so that way when they get on the network you can already have policies setup to support them.  HTH!

[paul]

As people have said there are several places to add MAC addresses into ISE.  When I am educating customers on ISE I always refer them to Context Visibility->Endpoints.  This screen allows you to easily import from a CSV and will provide you a template.  In addition if you are adding a single MAC address or editing an existing MAC address it is the only screen I know of that allows the description value to be input.  This is key for self-documenting MAC addresses and why they were added to a particular whitelist.