Controlling Anyconnect VPN clients based on the client's mac address

This is a short demo of how to control Anyconnect VPN client access based on the client's mac address using ASA+ISE. This is not a common deployment but some customers do use want to control access based on the client's mac address.
Big thanks to Hsing-Tsu Lai from the Cisco ISE team for validating this feature!

[@benoitlau8914]

Only provided the situation that PC allowd with correct MAC, Do you have the example of the client blocked by its incorrect MAC address？

[@ciscolivesecurityfan1136]

Hi @Benoit, if the client presents an unknown or incorrect MAC address, then they can be matched to another ISE policy that would not match any MAC address and be blocked/quarantined. Quite simple!

[@TheDonkey212]

@@ciscolivesecurityfan1136 if i use cisco rv series, how to implent this? Maybe by radius?