Whitelisting a MAC Address in ISE: A Complete Configuration Guide

Whitelisting a MAC address in Cisco Identity Services Engine (ISE) is one of the most common tasks network administrators handle when onboarding devices that can’t perform standard 802.1X authentication — printers, IP phones, badge readers, and other headless endpoints. But “whitelisting a MAC address” isn’t a single button in ISE; it actually involves adding the endpoint to the identity store, building an authorization policy around MAC Authentication Bypass (MAB), and — if you’re onboarding more than a handful of devices — importing them in bulk rather than one at a time. This guide walks through each of those pieces, points you to Cisco’s official reference material, and covers the security trade-offs worth understanding before you rely on MAC whitelisting as an access control method.

Adding a MAC Address to the ISE Endpoint Identity Store

The first step in whitelisting any device is registering its MAC address in ISE’s endpoint database and assigning it to an identity group your authorization policy can reference later.

1. Navigate to the Endpoints section. In the ISE admin console, go to Administration > Identity Management > Identities > Endpoints (in some ISE versions, this is also reachable through Context Visibility > Endpoints for viewing, with editing still done under Identity Management).
2. Click Add to create a new endpoint entry. Select the option to manually add a single MAC address rather than importing a file (bulk import is covered separately below).
3. Enter the MAC address. Type the device’s MAC address in the standard format ISE expects (typically colon- or hyphen-separated hex pairs, e.g., 00:1A:2B:3C:4D:5E). Double-check this against the device label or its switch/AP association, since a typo here means the device simply won’t match your policy later.
4. Assign a description. Add a clear description (device type, owner, or location) — this becomes important later when auditing which whitelisted devices exist and why.
5. Assign the endpoint to an Identity Group. Under Policy Assignment or Static Group Assignment, select or create an Endpoint Identity Group (for example, a custom group like “Whitelisted-Printers” or “Trusted-Devices”) that you’ll reference in your authorization policy.
6. Enable Static Assignment. Make sure the “Static Group Assignment” option is checked. Without this, ISE’s profiling engine may dynamically reassign the endpoint to a different identity group based on its behavior, overriding your manual whitelist entry.
7. Save the entry. Once saved, the MAC address exists in the endpoint database and is ready to be referenced by an authorization policy — but simply existing in the database doesn’t grant network access on its own. That access is controlled by the MAB policy configuration covered next.

With the endpoint registered, the identity group you assigned it to becomes the building block for the actual access-granting logic — which is where MAC Authentication Bypass comes in.

Configuring MAC Authentication Bypass (MAB) Policies

MAB is the authentication method that allows ISE to grant network access based on a device’s MAC address instead of 802.1X credentials, using the endpoint identity groups established above. Configuring it involves both an authentication policy and an authorization policy within a Policy Set.

1. Open your Policy Set. Go to Policy > Policy Sets and select the policy set that applies to the network access device (switch or wireless controller) the endpoint will connect through.
2. Confirm the authentication policy matches MAB requests. Within the policy set, the authentication policy rule for MAB typically matches on the condition Wired_MAB (for switches) or Wireless_MAB (for wireless controllers), which identifies that the connecting device is presenting its MAC address as credentials rather than 802.1X.
3. Set the identity source for MAB to the internal endpoints database. In the authentication policy, point the identity source sequence to the Internal Endpoints database so ISE checks incoming MAC addresses against the entries you added in the previous section.
4. Create or edit an authorization policy rule for whitelisted devices. Below the authentication policy, add an authorization rule with a condition that checks endpoint identity group membership — for example, EndpointIdentityGroup EQUALS Whitelisted-Printers, matching the group you assigned earlier.
5. Assign an authorization result/profile. Select or create an Authorization Profile that grants the appropriate network access — this might be a specific VLAN assignment, a downloadable ACL (dACL) limiting what the device can reach, or simple permit access, depending on how restrictive you want whitelisted access to be.
6. Order the rule appropriately within the policy set. Since ISE evaluates authorization rules top-down and applies the first match, make sure this rule is positioned before any broader “catch-all” or default deny rules that might otherwise match first.
7. Save and test. Save the policy set, then test with a whitelisted device to confirm it authenticates via MAB and receives the expected access, and test with a non-whitelisted MAC address to confirm it’s correctly denied or routed to a guest/restricted profile instead.

Note that MAB also requires corresponding configuration on the switch or wireless controller itself (enabling MAB on the relevant interface or SSID) — that side of the configuration happens outside ISE, on the network access device, and isn’t covered by the ISE-side policy steps above.

Bulk Importing MAC Addresses via CSV

Manually adding endpoints one at a time, as described above, works fine for a handful of devices — but for onboarding dozens or hundreds of MAC addresses, ISE’s bulk import feature is the practical option. ISE accepts a CSV file matching a specific column structure.

MACAddress,Description,PolicyAssignment,IdentityGroupAssignment,StaticAssignment,StaticGroupAssignment,ID
00:1A:2B:3C:4D:5E,Front Desk Printer,Unknown,Whitelisted-Printers,true,true,
00:1A:2B:3C:4D:5F,Lobby IP Phone,Unknown,Whitelisted-Phones,true,true,
00:1A:2B:3C:4D:60,Badge Reader - Main Entrance,Unknown,Whitelisted-Devices,true,true,

Column notes:

• MACAddress — required; must match ISE’s expected MAC format.
• Description — optional but recommended for auditing, as noted earlier.
• PolicyAssignment — the endpoint profiling policy; Unknown is commonly used when you don’t want ISE’s profiler to reclassify the device.
• IdentityGroupAssignment — the target Endpoint Identity Group, matching the group your authorization policy checks against (as configured in the MAB section above).
• StaticAssignment — set to true to prevent ISE from dynamically overriding the profiling policy.
• StaticGroupAssignment — set to true to lock the identity group assignment in place, corresponding to the “Enable Static Assignment” step covered earlier.
• ID — typically left blank for new imports; ISE generates this internally.

To import the file:

1. Go to Administration > Identity Management > Identities > Endpoints.
2. Click Import, then choose Import (as opposed to Generate a Template, which downloads a blank CSV with the correct headers directly from ISE if you want to confirm the exact format your version expects).
3. Upload your completed CSV file and confirm the field mapping matches your columns.
4. Submit the import and review the results summary for any rows that failed validation (commonly due to malformed MAC addresses or a referenced identity group that doesn’t yet exist).

Always generate a fresh template from your specific ISE version before a large import, since column names and available fields can shift slightly between releases.

Where to Find Cisco’s Official ISE Documentation

For the most accurate, version-specific menu paths and command references — since exact navigation can vary between ISE releases — Cisco’s official documentation should be your primary reference alongside this guide.

• Cisco Identity Services Engine Administrator Guides: Available at Cisco’s support site under the ISE product documentation section, organized by release version. Search for “Cisco Identity Services Engine Administrator Guide” plus your specific version number to get menu paths that match your deployment exactly.
• Endpoint Identity Groups and Endpoint Management: Covered within the Administrator Guide’s chapters on managing identities and endpoints, detailing static versus dynamic group assignment behavior referenced throughout this article.
• MAC Authentication Bypass (MAB) Configuration: Covered within the Administrator Guide’s authentication and authorization policy chapters, including both the ISE-side policy configuration and references to the corresponding switch/WLC-side MAB configuration.
• Bulk Import/Export of Endpoints: Documented within the endpoint management chapters, including the exact CSV template format for your specific ISE version — always cross-check this against the template ISE generates directly, since it reflects your exact deployed version rather than a generic reference.

Bookmarking the documentation page for your specific ISE release (rather than a general search result) is worth doing before a major deployment, since Cisco updates these guides with each release and menu paths do shift over time.

Is MAC Whitelisting in ISE Actually Secure?

MAC-based whitelisting is convenient, but it comes with real security trade-offs worth understanding before you rely on it as your primary access control method.

Is a whitelisted MAC address a strong form of authentication? No. A MAC address is not a secret — it’s broadcast in plaintext with every frame a device sends, and it can be viewed by anyone with basic network monitoring tools. MAB should be understood as identifying a device, not authenticating it with any real cryptographic assurance.

Can someone spoof a whitelisted MAC address? Yes. MAC address spoofing is trivial with widely available tools — an attacker who identifies a whitelisted MAC address (for example, by monitoring traffic on the same network segment) can configure their own device to present that same address and potentially gain the same access.

How does profiling help reduce this risk? ISE’s profiling engine can help detect anomalies by fingerprinting device behavior — DHCP requests, HTTP user-agent strings, and traffic patterns — beyond just the MAC address itself. A profiled mismatch (for example, a MAC address whitelisted as a printer suddenly behaving like a laptop) can trigger a policy change or alert, adding a layer of detection that static MAC whitelisting alone doesn’t provide. Keep in mind, though, that enabling profiling for this purpose means being more selective about when to use the “static assignment” setting described earlier, since strict static assignment can suppress the very reclassification that makes profiling useful for catching spoofing.

What’s the recommended way to limit exposure when using MAB? Restrict whitelisted devices to the minimum access they actually need using a downloadable ACL or a tightly scoped VLAN — as referenced in the authorization profile step above — rather than granting broad network access. Combining this with regular audits of the endpoint database (removing stale entries) reduces the attack surface even if a MAC address is spoofed.

Should MAB be used instead of 802.1X wherever possible? No — MAB is intended as a fallback for devices that genuinely can’t perform 802.1X authentication, not a replacement for it. Wherever a device supports 802.1X with real credentials or certificates, that method provides meaningfully stronger security than MAC-based whitelisting alone.

Put together, whitelisting a MAC address in ISE is a straightforward, well-documented process — but the real work isn’t just adding the entry, it’s building the authorization policy, identity group structure, and security safeguards around it so that MAB does its job as a controlled fallback rather than an open door.

Please follow and like us: