topic Conditions missing for authentication policy in 2.3 in Network Access Control

Conditions missing for authentication policy in 2.3

Charlie Dean — Sun, 17 Sep 2017 17:39:01 GMT

Hi everyone,

I am working on a POC for ISE using version 2.3. I'm new to ISE so I apologize if this is an obvious question. I couldn't find anything in the forum or docs either. Ok to the question.

I am following Katherine McNamara's blog post ISE - Dot1x Policy Configuration

In the post she uses a network access condition that matches certificate attributes that then results in specific identity sequences. I like this approach as it would allow us to collapse our corporate and byod SSIDs into one and assign different roles and VLANs starting with which certificate the client has. This is one of our goals with moving to a full NAC solution such as ISE.

My issue is when I go to add this condition in my authentication policy the condition is missing. Are there limitations on which conditions can be used where? Was there a change in how conditions work in 2.3? I've skimmed through documentation and the forums and I can't find any mention of this.

Screenshot of the condition:

Thanks!

Re: Conditions missing for authentication policy in 2.3

hslai — Sun, 17 Sep 2017 17:52:45 GMT

The right-hand-side (RHS) in this instance is a text input so we simply type in the text string.

Video Link : 16601

Re: Conditions missing for authentication policy in 2.3

hslai — Sun, 17 Sep 2017 17:59:25 GMT

See also the video walk-through of the policy UI in What's New in ISE 2.3?

Re: Conditions missing for authentication policy in 2.3

Charlie Dean — Sun, 17 Sep 2017 18:15:16 GMT

Hi. The issue isn't creating the condition. I had our TLD in there, I just blacked it out. The issue is when I try and use the condition in a authentication policy. It doesn't show up.

Re: Conditions missing for authentication policy in 2.3

hslai — Sun, 17 Sep 2017 18:17:59 GMT

You can use it in authorization policy rules only. [Correction] We can't use it in any policy set conditions but we can use it in authentication policy conditions inside a policy set.

Certificate attributes are not yet available at that point in determining which protocols to use. It's removed to resolve CSCvc98033.

Re: Conditions missing for authentication policy in 2.3

Charlie Dean — Sun, 17 Sep 2017 18:26:14 GMT

Ok, I think that was the answer I was looking for. Is there a doc I can reference that shows which condition types can be used where in a policy?

Re: Conditions missing for authentication policy in 2.3

hslai — Sun, 17 Sep 2017 18:37:01 GMT

Please note that I revised my last response. AFAIK it's documented in CSCvc98033 only.