Question about Vendor MAC based VLAN Access

[JoachimGebhardt]

Hey,

for some project, we try to figure out, how to do a Vendor MAC based VLAN Access with Meraki MS best.

Examples:

All Printers - VLAN 100

Vendor X - MAC 00:01:AA

Vendor Y - MAC 03:05:AA

All Phones - VLAN 200

.....

We already did some Test with NPS Radius, Packetfence but we are not happy at all.

Maybe you have some ideas for us.

Thanks in Advance

[alemabrahao]

The best tool for your case is Cico ISE.

https://community.cisco.com/t5/security-knowledge-base/how-to-integrate-meraki-networks-with-ise/ta-...

https://community.cisco.com/t5/security-knowledge-base/dynamic-attribute-with-ise-mac-address-matchi...

[KarstenI]

+1 for Cisco ISE, MAC-based access is easy and the ISE will make it much easier than for example NPS to move to 802.1X later.

[JoachimGebhardt]

OK, thanks for your replies.

As I figured out, we will need ISE Advantage Licenses for profiling. Am I right?

[KarstenI]

Yes, Advantage or "better" is needed for profiling. But only for the devices that get their authorisation by elements from profiling.

[KarstenI]

But you only need profiling if you want the system to detect the type of device. If you are willing to classify your MAC-addresses into groups manually (or by import from a CSV where the mapping is available), the Essentials-license is enough. And that license is quite cheap.