AMP and McAfee - Response

[Jason Maynard]

Hi Folks,

Looking for confirmation -

• When leveraging eAMP and integration with ISE. If the asset once authenticated using 802.1x is found at any point to be classified as catastrophic does ISE automated the response using COA - EX: moves the asset into a quarantined VLAN and adds a DACL - this could also assign an SGT but is not required... or is this a manual action one has to take.

• When leveraging McAfee and DXL and integration with ISE. If the asset once authenticated using 802.1x is found at any point to be classified as catastrophic does ISE automated the response using COA - EX: moves the asset into a quarantined VLAN and adds a DACL - this could also assign an SGT but is not required... or is this a manual action one has to take.

Thanks,

Jason

[Nidhi · Accepted solution]

Hi Jason,

with AMP, the CoA action is manual. but if ISE is integration with FMC, this will be automatic.

regarding integration with DXL, there are couple of use cases. you can refer to the link here to understand the mitigation action - McAfee DXL and Cisco pxGrid Integration