topic Re: Device or Identity based rules for non-AD devices/users in General Topics

Device or Identity based rules for non-AD devices/users

Kryten — Tue, 12 Dec 2023 15:10:22 GMT

Hello!

I have a customer who is extensively using Identitiy based Policies for its users and now faces a challenge that I don't see a good solution for (yet):

They have a bunch of users with devices (Ipdas/IOS) that have no connection to the AD, but still need their own set of rules in the policy.

First I suggested to assign them a specific subnet, but it seems that is not possible, as they have to use a WiFi SSID which is shared with other users and devices.
Having them authenticate with machine certs is also no option here according to the customer.
Now the only option that comes to my mind would be the usercheck page where they can log in to get access. This should work with local (=non-AD users), right?
Would there be any other option I just missed? Something more transparent for the user maybe? Some other way to have them authenticate with a local account that I do not think of yet?

Any input on this would be great!

Cheers,
Alex

Re: Device or Identity based rules for non-AD devices/users

Chris_Atkinson — Tue, 12 Dec 2023 15:29:19 GMT

Does the WiFi authenticate users against something like Cisco ISE or Aruba Clearpass or is it much simpler?

Re: Device or Identity based rules for non-AD devices/users

Kryten — Thu, 21 Dec 2023 10:30:17 GMT

Sadly not...the only thing they authenticate against is and MDM running on VMWare (workspace one I guess). I am not sure if it is possible to get usable accounting data from that...

Another idea just came up though: When they get their IP assigned from DHCP, DNS entries are created for the internal domain. Would it be possible to create domain objects for these DNS names and use them as source in the rulebase?

Re: Device or Identity based rules for non-AD devices/users

PhoneBoy — Fri, 22 Dec 2023 23:30:01 GMT

As long as the gateway can resolve the DNS names, that's one option.