Passive ID - Security Group Tags

michaellperrin — Mon, 11 Mar 2019 07:16:09 GMT

I'm looking to replace my CDA with ISE for transparent user auth for our WSA.

The thing that I'm seeing is when I want to add users and groups to an access policy, I cannot add AD Groups like I can with the CDA setup. I can only use SGT's. That's fine for wireless users who auth with dot1x because I can add the SGT based on AD group.

For wired users not using dot1x passive ID maps the user to the IP, and If I add the username to the access policy on the WSA it works, however these users don't have a SGT. Is there anyway to add a SGT to an AD group? Or anyway to make a policy on the WSA using an AD group with PassiveID and ISE?

Hello,

Wed, 19 Jul 2017 14:22:27 GMT

Hello,

i have same problem, you solved this?

thanks

I heard it's coming to WSA,

michaellperrin — Wed, 19 Jul 2017 14:49:43 GMT

I heard it's coming to WSA, but not yet supported.

topic Passive ID - Security Group Tags in Network Access Control

Passive ID - Security Group Tags

Hello,

I heard it's coming to WSA,