topic Re: ISE 2.3 Setting default Authentication Policy to DenyAccess will delete Auth Policy in Network Access Control

ISE 2.3 Setting default Authentication Policy to DenyAccess will delete Auth Policy

Arne Bier — Tue, 21 Nov 2017 03:38:30 GMT

Running ISE 2.3 patch 1 and I noticed today that when I change the Authentication Policy Default to "Deny Access" then the entire Authentication Policy gets wiped out, and there is no way to rebuild it.

Only way is to delete the entire Policy Set and start again. Is it no longer allowed to make the default Auth Policy DenyAccess?

Re: ISE 2.3 Setting default Authentication Policy to DenyAccess will delete Auth Policy

hariholla — Tue, 21 Nov 2017 09:11:17 GMT

You are hitting CSCvg44615 looks like.

~Hari

Re: ISE 2.3 Setting default Authentication Policy to DenyAccess will delete Auth Policy

Arne Bier — Tue, 21 Nov 2017 11:50:51 GMT

I have to say these bugs are getting a bit rediculous now.

Re: ISE 2.3 Setting default Authentication Policy to DenyAccess will delete Auth Policy

hslai — Tue, 21 Nov 2017 16:48:17 GMT

There is a hot patch for this. Please ask TAC to request for it.

Re: ISE 2.3 Setting default Authentication Policy to DenyAccess will delete Auth Policy

Arne Bier — Wed, 22 Nov 2017 04:33:51 GMT

I opened a TAC case today and the TAC jumped right onto it. But after some research it turns out this is not a trivial patch that can be applied. TAC informed me that it would take a few days to get it from BU.

At that point I decided to rather wait for the official patch because it sounded like it could turn into a mission and I don't want complications when the official patch is applied.

Re: ISE 2.3 Setting default Authentication Policy to DenyAccess will delete Auth Policy

hslai — Wed, 22 Nov 2017 05:50:56 GMT

If your ISE 2.3 has no other hot patches applied yet, the existing hot patch should work. If you share the case number, I can take a look and check for the particular.