topic ISE Authorization profile in Network Access Control

ISE Authorization profile

dharmendra2shah — Mon, 11 Mar 2019 02:38:18 GMT

I am trying to create an authorization profile in ISE. My vlan for that profile is 50. When I try to add the Tag ID as 50 it is not allowing me to do so.

The message I am getting is : “Tag ID should contain only numerical value and in the range 0-31. How can the vlan be 0”. How to deal with this issue when my vlan ids are higher then 31.

I was wondering if anyone else had similar issue? Or am I missing anything.

ISE Authorization profile

Tarik Admani — Thu, 04 Oct 2012 16:45:32 GMT

Please post a screenshot of what you are trying to configure.

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE Authorization profile

dharmendra2shah — Thu, 04 Oct 2012 16:48:10 GMT

ISE Authorization profile

Tarik Admani — Thu, 04 Oct 2012 16:50:47 GMT

Hi,

Leave the tag id alone, you need put the vlan name/number in the field right next to it.

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE Authorization profile

dharmendra2shah — Thu, 04 Oct 2012 17:12:22 GMT

Thanks Tarik. What is the purpose of Tag ID. If I leave it blank I get an error message."Please configureTag ID for the definedVlan in common taks".

I can just put any Tag ID (eg :1) and put the actual Vlan id (50) in ID/Name.

Just curious what is the purpose of Tag ID?

ISE Authorization profile

vikasyad — Tue, 28 May 2013 23:27:26 GMT

Please review the below links which might be helpful:

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_authz_polprfls.html

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_authz_polprfls.pdf

ISE Authorization profile

Ravi Singh — Tue, 30 Jul 2013 03:50:03 GMT

The tag, also called the security group tag (SGT), allows ISE to enforce access control policies by enabling the endpoint device to act upon the SGT to filter traffic.

ISE Authorization profile

Tarik Admani — Tue, 30 Jul 2013 03:52:07 GMT

Ravi,

Ds, was referring to the radius attributes that are used for dynamic vlan assignment (the 3 attributes) and the tag which passes back the vlan id can be configured. His question was referring to what the different values stood for.

Tarik Admani
*Please rate helpful posts*

Hello,

Stefan Tiefel — Tue, 06 Dec 2016 13:50:36 GMT

Hello,

I have the same question. Do you now know what's the purpose of Tag ID?

Kind regards,

Stefan

Re: ISE Authorization profile

t-lucas — Wed, 20 Feb 2019 09:29:33 GMT

Ok so what does the "Tag ID" stand for or do? What is it's purpose? I can't seem to find any details for it in the ISE documentation.

Thanks for any help on this.

Re: ISE Authorization profile

Damien Miller — Wed, 20 Feb 2019 15:57:24 GMT

If we look at RFC 4675 for RADIUS VLAN and Priority Attibutes, it defines Tag ID is the tag indication field and it is one octet in length. It indicates whether the frames on the VLAN are tagged (0x31) or untagged (0x32). In ASCII this coincidences to 0x31 = ASCII '1' or untagged 0x32 = ASCII '2'.

This defaults to 1 in ISE 2.4.

Re: ISE Authorization profile

howon — Wed, 20 Feb 2019 16:15:10 GMT

Tag is used to combine multiple attributes so the NAD understands multiple attributes being sent to be processed together. I have yet to see any use case for multiple tags. But in the case of VLAN assignment, you have to send 3 separate attributes which makes the dVLAN work so the tag glues three attributes together to make it work. I am showing example where the tag is 2 for the sake of discussion, but ISE will do this automatically when using common tasks for VLAN assignment: