topic HQ and Remote Wired Guest VLAN in Network Access Control

HQ and Remote Wired Guest VLAN

ttran — Mon, 11 Mar 2019 02:40:08 GMT

Hello all,

I am having trouble to create a standard condition for Policy Authorization. Basically there are HQ and remote locations configure for guest access.

Each location has its own guest vlan. On ISE the standard rule are:

Standard Rule 1 if Unknown AND Wired_MAB then Guest_Access

This rule is working good for HQ.

Standard Rule 2 if (Unknown OR MTL_Devices) AND Wired_MAB_MTL_Guest then Montreal_Guest

This rule is design for remote but Standard rule 1 is taking over because first match applied and since the OR condition may cause some problem

with internal users since the condition is Unknown OR MTL_Devices. There is no AND condition for this.

Let me know if anyone has idea or have solved this problem.

Thank you.

HQ and Remote Wired Guest VLAN

Tarik Admani — Fri, 12 Oct 2012 15:44:59 GMT

Hi,

You need to change the order of your rules, ISE uses the first matched rule from top to bottom, in your case the MTRL is matching the first rule since it is more open than the rule below which has the check for the network device.

Please change the order and see if this fixes your issue, if this doesnt work, post a screenshot of your policies just to make sure we are on the same page.

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: HQ and Remote Wired Guest VLAN

ttran — Fri, 12 Oct 2012 20:07:35 GMT

Hi Tarik,

Thanks for relying. I tried different way and still no good. Here is the screen shot.