topic ISE policy in Network Access Control

ISE policy

BigK — Sun, 17 Feb 2019 17:36:16 GMT

Trying to understand and apply policy set on ISE 2.4 on the lab environment. Your comments and advice on ISE policy that I just built are appropriated.

Policy set name is self-explanatory
Conditions: Device must be Wired_802.1x or Wired_MAB and be connected to Karim_lab-switch.
Use the allowed protocols that are in Default Network Access

AUTH_C Policy

AUTH_C Policy name is self-explanatory
Conditions: Device must be Wired_802.1x or Wired_MAB and be connected to Karim_lab-switch.
Use internal users and if it fails continue to default.

AUTH_Z Policy

AUTH_Z Policy name is self-explanatory
Conditions: Device must be Wired_802.1x or Wired_MAB and be connected to Karim_lab-switch.
Result : Permit access to Karim_lab-switch.

Re: ISE policy

Mohammed al Baqari — Mon, 18 Feb 2019 08:04:00 GMT

You are using AND operation in your configuration which wrong and should be OR. Also, you can't have two authorization profiles as result in one rule

Re: ISE policy

socratesp1980 — Mon, 18 Feb 2019 06:08:30 GMT

Based on your screenshot a device needs to be authenticated with bot dot1x AND mab. Your permit access authorization policies will conflict your karim_lab_switch authorization policy. What is you are trying to do? Device admin? or dot1x for a network device?