topic Re: ISE external admin Data access in Network Access Control

ISE external admin Data access

joeharb — Fri, 14 Dec 2018 17:00:27 GMT

I have created a new Policy for admin access. It references a Group in AD, I am able to login with out issues and have access to all menu's but I don't have access to some of the Data. For example I don't see any of the Endpoint or User Identity Groups. I have configured the policy for both Super Admin Menu and Data access, see image.

What am I missing?

Thanks,

Joe

Re: ISE external admin Data access

hslai — Sun, 16 Dec 2018 03:10:16 GMT

You may map AD groups to the built-in admin groups (see the attached screenshot), instead of creating new ones, although what you configured should have worked, too. Please engage Cisco TAC to troubleshoot.

Re: ISE external admin Data access

Mohammed al Baqari — Sun, 16 Dec 2018 05:47:50 GMT

I have seen similar problem in version 2.3. It seemed to be a bug because all required permissions were allowed,

Re: ISE external admin Data access

hslai — Mon, 17 Dec 2018 01:30:42 GMT

If an admin user matched to multiple ISE admin groups, then it could be either CSCvd20214 or CSCvk10156.

Re: ISE external admin Data access

BigK — Mon, 17 Dec 2018 03:24:48 GMT

@joeharb

definitely a bug. See below

CSCvd28829

Re: ISE external admin Data access

hslai — Mon, 17 Dec 2018 03:29:04 GMT

CSCvd28829 is addressed in ISE 2.2 Patch 2 or above and ISE 2.3 FCS. Joe could run into it, if his setup just upgraded to ISE 2.2 and not yet patched to the latest.

Re: ISE external admin Data access

joeharb — Sat, 22 Dec 2018 00:36:26 GMT

This is a fresh install of 2.4.

Re: ISE external admin Data access

hslai — Sat, 22 Dec 2018 03:24:08 GMT

Please try what I gave in my first response to your post. If that not helping, open a Cisco TAC support case and troubleshoot further.