Identity rules priority

boris.majstorovic — Mon, 11 Mar 2019 00:49:51 GMT

Our customer want to implement 802.1x autentication with ACS 5.2 and AD as external identiti base.

But when non802.1xcapable device conect to 802.1x enabled switch port autentification should be with MAC.

We have configured switch with 802.1x and MAC auth bypass.

Also define AD as external identiti base, and MAC addreses in internal hosts.

There are two policies in

Access Policies > ... > Access Services > Default Network Access > Identity

2.AD NDG:Location in All Locations AD1

1. Non802.1xCapableDevices NDG:Location in All Locations Internal Hosts

The problem is taht only frst rule is considered. If we try to autenticate with LapTop with 802.1x disabled (MAC is in internal host) autentication - OK. When we enable 802.1x on LAN there is no autentication (user not found).

After we changed order of policies:

1.AD NDG:Location in All Locations AD1

2. Non802.1xCapableDevices NDG:Location in All Locations Internal Hosts

The situation is reversed, user is autenticated but MAC isn't.

Where is the error?

Thanks

Re: Identity rules priority

Yudong Wu — Tue, 15 Feb 2011 22:44:20 GMT

In Access Policies > > Access Services > Default Network Access > Identity, if you use " Rule based result selection"

ACS should just usethe first match.

You can configure a "Idnetity Store Sequence" in Users and Identity Stores > Identity Store Sequences, make sure you select the "internal host" first and then AD. Then you can use this "identity store sequence" in "Default Network Access > Identity".

Re: Identity rules priority

boris.majstorovic — Thu, 24 Feb 2011 20:20:10 GMT

Thanks

It solved the problem

topic Re: Identity rules priority in Network Access Control

Identity rules priority

Re: Identity rules priority

Re: Identity rules priority