topic EasyConnect Group Mapping in Network Access Control https://community.cisco.com/t5/network-access-control/easyconnect-group-mapping/m-p/3486491#M536704 <HTML><HEAD></HEAD><BODY><P>I've set up EasyConnect (ISE 2.1.0.474) with my 2008 AD servers following the document posted on the community.&nbsp; I am seeing all working OK except I am not getting the group mapping.&nbsp; The connections are falling through the "Domain User" and Domain Admin" rules to the Limited Rule.&nbsp; In the live log I do see the username appended to the mac address&nbsp; in one entry and then a second entry for the user/ip mapping. The debug log looks the same as the posted document.&nbsp; In the debug I do not see any Group reference.&nbsp; How is the group mapped to the user with easyconnect? I believe my AD is working ok because external group mapping works when using an 802.1x client.&nbsp; How can I troubleshoot this to see why I am missing the user to group mapping?</P><P></P><P>Thanks</P></BODY></HTML> Fri, 16 Dec 2016 17:57:31 GMT scamarda 2016-12-16T17:57:31Z EasyConnect Group Mapping https://community.cisco.com/t5/network-access-control/easyconnect-group-mapping/m-p/3486491#M536704 <HTML><HEAD></HEAD><BODY><P>I've set up EasyConnect (ISE 2.1.0.474) with my 2008 AD servers following the document posted on the community.&nbsp; I am seeing all working OK except I am not getting the group mapping.&nbsp; The connections are falling through the "Domain User" and Domain Admin" rules to the Limited Rule.&nbsp; In the live log I do see the username appended to the mac address&nbsp; in one entry and then a second entry for the user/ip mapping. The debug log looks the same as the posted document.&nbsp; In the debug I do not see any Group reference.&nbsp; How is the group mapped to the user with easyconnect? I believe my AD is working ok because external group mapping works when using an 802.1x client.&nbsp; How can I troubleshoot this to see why I am missing the user to group mapping?</P><P></P><P>Thanks</P></BODY></HTML> Fri, 16 Dec 2016 17:57:31 GMT https://community.cisco.com/t5/network-access-control/easyconnect-group-mapping/m-p/3486491#M536704 scamarda 2016-12-16T17:57:31Z Re: EasyConnect Group Mapping https://community.cisco.com/t5/network-access-control/easyconnect-group-mapping/m-p/3486492#M536705 <HTML><HEAD></HEAD><BODY><P>ISE AD connector will perform the lookups to determine the AD user group mapping, so you may debug it as if the rules are for regular AD groups/attributes.</P></BODY></HTML> Sat, 17 Dec 2016 04:36:26 GMT https://community.cisco.com/t5/network-access-control/easyconnect-group-mapping/m-p/3486492#M536705 hslai 2016-12-17T04:36:26Z