Endpoint Identity Management

What it is

Endpoint identity management is how you organise, edit and clean up the endpoints that ISE knows about.

ISE builds a database of endpoints, each keyed by MAC address. The record holds the profile, the identity group, and the attributes that probes collected. You can leave this to profiling, or you can step in by hand.

How it works

Endpoints land in identity groups, either by profiling or by your own assignment, and policy uses the groups.

The endpoint record

Each record holds a MAC address, the endpoint profile, the identity group, and attributes such as IP address and host name. You can see the list under the context visibility pages and under the identity management pages in the admin portal.

An endpoint appears the first time ISE sees its MAC address, for example in a MAB request or a DHCP packet.

Endpoint identity groups

An identity group is a bucket of endpoints. Policy can match on a group, so you do not need a rule per MAC address.

ISE has built in groups, such as:

• Unknown: Endpoints that profiling could not identify.
• Profiled: The parent of groups that profiling creates.
• Registered devices: Devices that users registered, for example through BYOD.
• Guest endpoints: Devices that guests used.
• Blocked list: Endpoints that must be denied access.

You can add your own groups and nest them under others. A group can be used in an authorization rule, as in, if the endpoint is in the printers group, give the printer profile.

Static assignment

Profiling normally places endpoints. You can override it with a static assignment. A statically assigned endpoint keeps its group, even if profiling disagrees.

You can assign a static group, a static profile, or both. Use it for devices that profiling cannot identify well, such as unusual lab equipment.

Adding and importing endpoints

You can add an endpoint by hand with its MAC address, group and profile. For many devices, you import a file. The import file lists the MAC addresses and the groups to use.

A typical use is to load a list of printers or door controllers before they connect, so that the first MAB request already matches a rule. You can export the list too, which helps for backups and for audits.

The blocked list

The blocked list is how you deny a lost or banned device. Add the endpoint to the blocked list group. An authorization rule that matches the group gives a deny result, or sends the user to a page that says the device is blocked.

ISE has a default rule for this. Make sure it sits high in the policy, above the rules that permit access, or the endpoint is accepted before it reaches the block rule.

Purging old endpoints

Over time the database fills with endpoints that no longer connect. Purge rules remove them. You set a rule on how long an endpoint can be inactive, and ISE removes those that match.

Purge rules can be based on the profile or on the group, so you can keep registered devices longer than unknown ones. An endpoint that connects again is simply learned again.

Keep purge in step with your guest and BYOD rules. If a registered device is purged, the user may need to register it again.

Endpoint attributes and custom attributes

Along with the built in attributes, you can define custom attributes for endpoints. A custom attribute is useful to store a business value, such as the owner or the location. Policy can then use it in a condition.

Using the groups in policy

After the groups exist, write the rules. The rule can use the group, the profile, or both. Use groups for broad classes and profiles for specific devices.

Verify

In the live logs, a MAB request shows the endpoint group that the policy used. On the endpoint page, check the profile and group. If an endpoint is in the wrong group, check whether a static assignment holds it there.