topic Re: ISE 2.6 - Adding external source ( AD groups to Identity groups) in Integrated Security Platform

ISE 2.6 - Adding external source ( AD groups to Identity groups)

tiki_turtle — Sun, 19 Apr 2020 18:38:26 GMT

I am trying to consolidate groups from AD into logical groups on ISE. However, I can't seem to find a way to do this at all. I am migrating from ACS and see identity groups / group mapping settings that I can apply to authZ policies...but cannot find anything anywhere to help me do the same in ISE. Any help would be greatly appreciated.

Re: ISE 2.6 - Adding external source ( AD groups to Identity groups)

Francesco Molino — Mon, 20 Apr 2020 03:35:18 GMT

Hi

I'm not sure I'm getting your point.
When you are in the active directory external identity source, you can add a group from your AD which can be used them in your authorization rules within your policy sets.

Can you share what your trying to reproduce from your acs and i may be able to provide screenshots on how to do it on ise tomorrow?

Re: ISE 2.6 - Adding external source ( AD groups to Identity groups)

tiki_turtle — Wed, 22 Apr 2020 14:22:56 GMT

Hi Francesco - I am trying to group the AD groups that I have added to ISE into other logical groups. ( ie I take acme.com/administrators and acme.com/NOC and make a new group on the ISE called netadmins comprised of these two groups

Re: ISE 2.6 - Adding external source ( AD groups to Identity groups)

Francesco Molino — Thu, 23 Apr 2020 02:16:40 GMT

If it's for an authorization profile, you'll need to create a condition with OR conditions and these 2 groups.

You can't create a logical group and add AD groups.