topic Authorization Profile Reporting in Network Access Control

Authorization Profile Reporting

paul — Mon, 11 Sep 2017 17:50:02 GMT

Okay this will be a little venting of a post, but want to ask about a few issues in reporting on ISE authentication activity. In our best practices we have the following:

Every rule in ISE has a unique authorization profile created.
Every authorization profile is well named and self documenting using the following standards:
1. SSID_<SSID Name>_<Auth Protocol>_<Description>, i.e. SSID_Employee_PEAP_Domain_Computer
2. Wired_MAB_Descption, i.e. Wired_MAB_Printer
3. Wired_Dot1x_<Auth Protocol>_<Description>, i.e. Wired_Dot1x_PEAP_Domain_Computer
4. VPN_<tunnel group/use case>_<Description>, i.e. VPN_Employee_IT_Admins

With this naming convention, we can hide the Authentication Policy and Authorization Policy in the Live Log window as they are irrelevant. The Authorization Profile column tells the user exactly what happened. The Authorization Profile is the result applied to the user and what is important. The rule name is irrelevant, although we name them accordingly.

In ISE 2.1, I identified a bug (CSCvb46991) in the Context Visibility screen where the Authorization Profile column was putting the rule name in by mistake. It seems like the solution for that bug was to get rid of the Authorization Profile column all together. So instead of fixing the issue, the ability to filter on our well name results isn't an option on the Context Visibility screen.

In the RADIUS authentication reports, you can add the "AZN Policy" (this is a 1.0 name I think... why hasn't this been updated), but you can't filter on that column. Makes no sense why you can't filter on any of the columns.

Any reasons we can't use Authorization Profiles as filtering conditions in Context Visibility and Reports? It looks silly to customers when they have well named results and they can't use them on all screens when in my mind there is no difficult technical reason behind it.

Re: Authorization Profile Reporting

Craig Hyps — Mon, 11 Sep 2017 19:06:28 GMT

Yes, it is odd that AuthZ Profile removed, but you can add it back by creating a new view with the Authentication attributes set and adding the SelectedAuthorizationProfiles attribute. I will copy PM on visibility on this post.

Re: Authorization Profile Reporting

paul — Mon, 11 Sep 2017 19:11:56 GMT

Ahh thanks for that tip Craig. Never thought about creating a new view. If the AZN Policy column was searchable in reports then we would be back in business.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250

Re: Authorization Profile Reporting

hslai — Tue, 12 Sep 2017 17:14:39 GMT

Did you mean AZN profiles instead of AZN policy as the latter implies Authorization rule and can already be filtered?

Re: Authorization Profile Reporting

paul — Tue, 12 Sep 2017 17:19:20 GMT

Authorization rule is the rule name not the applied Authorization Policy. I should be able to filter on the policy but can't

Sent from my iPhone

Re: Authorization Profile Reporting

hslai — Wed, 13 Sep 2017 02:48:26 GMT

I forwarded your request to enable filtering on authorization profiles to our internal teams. My guess is that any additional filters come with a cost of indexing.

Re: Authorization Profile Reporting

hslai — Thu, 14 Sep 2017 05:31:09 GMT

CSCvf95756 opened on the request to allow filtering on Authorization Profiles.

As part of CSCvb46991, we found in ISE 2.1

that the column "Authorization Profile" displaying "Authorization Policy (rule name)" and

that the column "SelectedAuthorizationProfiles" mapping to "Authorization Profiles".

The fix corrected the column/field names:

Authorization Policy --> Authentication Policy (rule name)

Authorization Profile --> Authorization Policy (rule name)

Re: Authorization Profile Reporting

paul — Thu, 14 Sep 2017 05:36:47 GMT

Thanks.

So the Context Visibility->Endpoints is functioning as design and we can’t add in authorization profile without building a custom view?

If they can allow is to filter in the reports though that will be very nice. Most times we are looking at data in live logs or the reports.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250

Re: Authorization Profile Reporting

hslai — Thu, 14 Sep 2017 06:06:20 GMT

That is correct or at least for now, regarding the built-in views have fix sets of fields.