Address Spoofing Mac Address From

If we give the device an IP address, ISE can ingest the DHCP attributes and we will be able to tell from the ISE UI that a different device has been plugged in even though the endpoint was flagged by AED.

I found that while the problem was well defined and easily researched, there were no simple prescriptive recipes for a solution.

I thought it might be helpful to share this solution in the hopes it could be useful to others.

The problem with this approach is MAC address spoofing is trivial to implement.

However, with a defense in depth approach using basic tools and techniques, the risk and impact can be largely mitigated.

Address Spoofing Mac Address From

A network penetration tester easily bypassed their access controls by cloning a mac address from an IP phone to a Linux laptop computer.

In general, Network Access Control (NAC) implementations take a phased approach to control risk and get immediate value from the tool, and this was the case here.

ISE recognized her computer as the IP phone, and she was granted unrestricted access to the network.

The primary key for this data structure is the MAC address of the endpoint.

The ISE user interface provides an interface to view the endpoint database and inspect individual endpoints through the Context VisibilityEndpoints Menu.

However, we can use the profiling information to authorize a specific level of access, which we will review later.

We then use that endpoint policy to decide how much access (if any) to authorize.

The policies are arranged in a tree-like structure from coarse to finer-grained.

The minimum score at each level of the tree has to be met before the child nodes will be evaluated.

It is the functional equivalent of putting users into groups for granting access to files and folders on a computer.

The dhcp-class-identifier change triggered the Anomalous Endpoint flag on the endpoint to true.

The absence of a value being sent (that was sent prior) does not equal a change as far as the profiler is concerned.

The TCF changed by -30 because the dhcp-class-identifier value is scored in two locations for 10 and 20 points, respectively.

I am going to unplug the laptop, delete the endpoint, and next, we will try the Ubuntu Laptop.

The result is that the laptop received the IPphones Authorization Profile.

If the residual attributes left from when the phone was plugged in were not persistent, this would trigger a reprofile and we would be able to do something.

The reasons the attributes are cached are understandable, but it presents a difficulty here.

It should be noted that not getting the class-id when it was received prior will not trigger AED.

In this case, I also conditioned on IP phones because I only want the scope to cover the specific assets of interest.

Mac Address Spoofing Windows 10