Trying to setup the most basic MAC based Access Control but need help

[Stephen_Stormon]

We know that XMC and NAC can do a whole lot, but initially all we want to do is this:

1) A system will be plugged into a port and will show up in the end-systems tab
2) An administrator will then add that to the "Allowed Devices" group which we have created (for simplicity, this group uses the "Default NAC Profile" which uses the "Enterprise User" Accept Policy)
3) All other systems that have not been added to the "Allowed Devices" group are blocked from accessing the network.

I have an isolated non-production switch that I want to test this on, but I have a question about the config and the rules.
1) We have one Configuration (IMS) that is currently in use on all switches. I have made a secondary Configuration (IMS - MAC Auth) which I wanted to use for MAC auth testing, but I can't figure out how to apply that to just the one switch I want to test on (it has been a while since we first deployed XMC/NAC and I don't know if I am just forgetting where the option is or if a whole new Policy Domain is needed to make this happen)?
2) If the other configuration can be assigned to just a switch for testing, will the attached rules accomplish what we want?

• Quarantine anything in the Blacklist group
• Send a notification for anything in the Assessment Warning group
• Allow anyone if the omni\XOS Administrators group to login to the switches (this currently works)
• Quarantine any system from which a user attempts to login to a switch but they are not in the omni\XOS administrators group
• Allow any system that is in the "Allowed Devices" group onto the network
• Block all other devices

I know that this means that we will have enable identity management on all ports and add all systems to the "Allowed Devices" group before enforcing those rules.

I'm new to the NAC side of things and know that it can cause issues when configured incorrectly, so all the help (and clarification to ideas that I am not understanding correctly) you can provide is welcome.

[Zdeněk_Pala]

You can use NAC Manager to change the config:

[Stephen_Stormon]

Where is the option to change which configuration is assigned to the engine? I can see that the "IMS" configuration is applied to this engine, but I can't remember where to go to change that setting.

[Zdeněk_Pala]

There is one access control configuration for group of engines. You can have more groups and each group can have own access control configuration.

there is always maximum one configuration for engine.

[Stephen_Stormon]

@Ronald Dvorak , so you are saying that there can only be one "Access Control Configuration" for all of NAC? I guess the only reason we haven't run into any issues yet is because the "Default" and "IMS" configurations are basically the same (shown below). It sounds like we should disable all the rules in the "Default" configuration (if we want to leave it around for reference), delete it and stick with our "IMS" one, or just use the "Default" one and delete our "IMS" one.

[Zdeněk_Pala]

two options how you can accomplish what I understand you want (May be I do not understand it)...

Option 1 = more scalable more "human error resilient":

• Create new configuration
• Create new engine group
• Assign your new configuration to new engine group
• Deploy new Access Control Engine and assign it to your new engine group
• connect your testing switch to the new Engine

now you can play with the switch and rules without affecting your production.

Option 2 = does need less resources

• Create new location based on your testing switch
• All your testing rules must have your new location in conditions
• Rules are processed from top to the bottom = your testing rules must be on the top

your scenario seems to be quite easy.
Rule #1 = if location and end-system is in Allowed Devices then apply the proper profile with policy
Rule #2 = if location then apply Deny profile with deny policy or Reject profile (needs to be created). by default deny profile does assign deny policy what does allow DHCP, DNS, ARP = so fingerprinting will work for you for non-approved devices