Device or Identity based rules for non-AD devices/users

[Kryten]

Hello!

I have a customer who is extensively using Identitiy based Policies for its users and now faces a challenge that I don't see a good solution for (yet):

They have a bunch of users with devices (Ipdas/IOS) that have no connection to the AD, but still need their own set of rules in the policy.

First I suggested to assign them a specific subnet, but it seems that is not possible, as they have to use a WiFi SSID which is shared with other users and devices.
Having them authenticate with machine certs is also no option here according to the customer.
Now the only option that comes to my mind would be the usercheck page where they can log in to get access. This should work with local (=non-AD users), right?
Would there be any other option I just missed? Something more transparent for the user maybe? Some other way to have them authenticate with a local account that I do not think of yet?

Any input on this would be great!

Cheers,
Alex

[Chris_Atkinson]

Does the WiFi authenticate users against something like Cisco ISE or Aruba Clearpass or is it much simpler?

[Kryten]

Sadly not...the only thing they authenticate against is and MDM running on VMWare (workspace one I guess). I am not sure if it is possible to get usable accounting data from that...

Another idea just came up though: When they get their IP assigned from DHCP, DNS entries are created for the internal domain. Would it be possible to create domain objects for these DNS names and use them as source in the rulebase?

[PhoneBoy]

As long as the gateway can resolve the DNS names, that's one option.