topic Re: Assign an IP from ISE for every User in Network Access Control

Assign an IP from ISE for every User

martucci — Thu, 23 Mar 2017 14:55:14 GMT

Hello,

a customer would like to do in ISE as it was possible in ACS where you could have a local account with an IP address associated to it.

In our case the user is a Remote Access user.

The accounts would be local to ISE (not AD) and could be more than 1000, so we cannot do it with a different rule for each user relying on different group policy on ASA or returning the IP from the AuthZ Policy.

Any idea on how to alternatively solve this issue?

Thanks

Re: Assign an IP from ISE for every User

hslai — Thu, 23 Mar 2017 15:06:01 GMT

Have you already tried it and found it not working?

I believe we are able to do this similarly to ACS, by defining a custom user attribute. Assuming the remote access headends take Radius:Framed-IP-Address, we may assign the user attribute dynamically to that. Attached are screenshots from ISE 2.2.

Re: Assign an IP from ISE for every User

martucci — Thu, 23 Mar 2017 16:22:41 GMT

Thanks a lot!

Yes, I did not think about that, thanks a lot