topic Multiple "MemberOf" in Network Access Control

Multiple "MemberOf"

cpaquet — Mon, 11 Mar 2019 02:54:02 GMT

Good afternoon,

How would ISE deal with an user that has multiple entries for "memberOf"for group assignment? Would ISE use the 1st MemberOf value it encounter to assign a group?

Thanks.

Cath.

Multiple "MemberOf"

nspasov — Tue, 18 Dec 2012 04:08:20 GMT

Hello Cath-

ISE will "read" the groups in the order that you have configured them in your authorization rules. So I would recommend that you place the more specific groups towards the bottom and the most common groups towards the bottom. For example:

IF member of executives then authorization profile executives_users

IF member of domain users then authorization profile regular_users

Thank you for rating!

Multiple "MemberOf"

cpaquet — Tue, 18 Dec 2012 12:02:34 GMT

Thanks Neno.

Could you please clarify your suggestion "...I would recommend that you place the more specific groups towards the bottom and the most common groups towards the bottom".

You mean placing the specific at the top and the generic at the bottom, right?

Thank you.

Cath.

Multiple "MemberOf"

nspasov — Wed, 19 Dec 2012 00:48:28 GMT

Yes, that was a typo on my end You want generic towards the bottom and specific towards the top. Think of it that way: Everyone is part of "domain users" so everyone would match that rule but not everyone would be a member of the "executives" so you would want the executives group to be above the domain users

Multiple "MemberOf"

cpaquet — Wed, 19 Dec 2012 12:38:30 GMT

Thank you Neno for all your help.

Regards,

cath.