topic Re: ISE selecting wrong Device Admin Policy in Network Access Control

ISE selecting wrong Device Admin Policy

Jeroen1001 — Wed, 28 Feb 2018 15:39:09 GMT

Dear expert,

I'm talking about the section under Work Centers > Device Administration > Device Admin Policy Sets.

In our setup, the device is present under 2 distinct Network Device Groups. One time using a supernet /24 (management subnet) and one time using a /32. This /32 is the devices' host address which is also part of the supernet of course .I'm talking about the section Administration > Network Device Groups

It appears ISE selects the Device Admin Policy based the most specific prefix. So the policy with the /32 will always win.

However, I want it to select the policy based on the order in which it is defined at Work Centers > Device Administration > Device Admin Policy Sets

So basically I want it to cycle through the defined policies like an ACL.

- Check first policy. No Match? Check second policy and so on.

Please explain how to do this.

Many thanks in advance.

Re: ISE selecting wrong Device Admin Policy

ognyan.totev — Thu, 01 Mar 2018 09:09:28 GMT

By default ISE always match first rule match applied.If first not match it continue to the next rule and etc.

It is important how you order rules.

Re: ISE selecting wrong Device Admin Policy

Jeroen1001 — Wed, 07 Mar 2018 17:27:37 GMT

It appears not to do this. It always goes to the same policy linked to the most specific IP. I can't find what's wrong so I decided to open a ticket with support!