topic Re: Authorization policy: Using the contains operator in Network Access Control

Authorization policy: Using the contains operator

dgaikwad — Fri, 28 Sep 2018 08:42:31 GMT

Hi Experts,

I would like to get some information regarding the behavior of the contains operator.

So, here I have two authentication policy, with called-station-ID contains Cisco and another one with called-station-ID contains Cisco1

When a user connects to SSID Cisco, the policy with SSID Cisco1 will not be evaluated and the policy containing Cisco will be evaluated?

My question is here is that since I am using contains operator here, does it match the entire string or it looks for the Cisco in Cisco1 and select that policy?

So, when a user connects to SSID Cisco, which policy will be evaluated? the one with Cisco1 or Cisco?

Re: Authorization policy: Using the contains operator

rcullum — Fri, 28 Sep 2018 10:47:18 GMT

Are you talking about authentication policies or authorization rules? If the latter, then the first match rule will win.

Re: Authorization policy: Using the contains operator

paul — Fri, 28 Sep 2018 11:14:17 GMT

You would need to put the more specific match first. In your case Cisco1.

Re: Authorization policy: Using the contains operator

Aravind Ravichandran — Fri, 28 Sep 2018 21:25:51 GMT

Hi,

Contains will match whole string and authorization policy works in order,if called station Id contains Cisco1 is first rule & cisco is second rule.user connects to Cisco ssid will be evaluated with Cisco policy.

Thanks,

Aravind

Re: Authorization policy: Using the contains operator

dgaikwad — Thu, 04 Oct 2018 09:28:09 GMT

So, if I configure the policy as follows:

If a user connects to SSID "Cisco", then also he will be evaluated based on the policy containing "Cisco1"? Right? 😕

Re: Authorization policy: Using the contains operator

Aravind Ravichandran — Thu, 04 Oct 2018 09:40:13 GMT

No,if user connects to Cisco ssid he will be evaluated based on second policy sets as the first policy sets doesn't match the ssid name.

Also in policy sets you are using equals not contains.

Re: Authorization policy: Using the contains operator

dgaikwad — Thu, 04 Oct 2018 10:16:46 GMT

The previous ones were created in a hurry just to visualize what I was trying to explain, here is the correct ones;

Now this proves, when the user selects Cisco SSID, he will be evaluated based on policy for Cisco and not from Cisco1, right?

This also shows that, the entire string is matched.

Re: Authorization policy: Using the contains operator

Aravind Ravichandran — Thu, 04 Oct 2018 11:00:23 GMT

Yes right, if it matches Cisco SSID & 802.1x

Thanks

Aravind

Re: Authorization policy: Using the contains operator

Nidhi — Thu, 04 Oct 2018 11:32:52 GMT

Hi Dinesh,

you can use the "Matches" operand to match the exact ssid.

Re: Authorization policy: Using the contains operator

paul — Thu, 04 Oct 2018 11:39:54 GMT

The matches would allow you to specify Regex to do an exact match, but you can also just use the ends with.

Ends with Cisco and Ends with Cisco1 do not overlap.