Switch Management Access using NAC Rules

[Christopher_Tay]

I have configured my X460-G2 switches to use NAC for management access.

I have 2 sets of switches and would like 1 AD group to manage any and another to manage just a subset.

The AD authentication and groups work fine.  I have tried to set up a rule that uses the “End-System”  criteria.  I have created an End-System group based on the switch IP (I tried the MAC as well) but the switches IP doesn’t seem to be recognized.

I have RADIUS authentication and accounting enabled.

Is this the correct way to create different access for switches?  If so what am I missing?

Is there a different rule I could create to accomplish this?

Thank you,

Chris

[Christopher_Tay]

Hi Stefan,

That worked exactly how I was hoping for.

Thank you for the help

Chris

[Stefan_K_ · Accepted solution]

Hi Chris,

 I have tried to set up a rule that uses the “End-System”  criteria.  I have created an End-System group based on the switch IP (I tried the MAC as well) but the switches IP doesn’t seem to be recognized.

Use a location group instead of an end-system group and it will work fine.

The location groups can be used for:

• limit rules on specific switches (as in this case)
• limit rules on specific switch-ports
• limit rules on specific access-points

Best regards
Stefan