topic Re: Network Access:ISE Host Name Condition in Network Access Control

Network Access:ISE Host Name Condition

joshhunter — Tue, 22 Nov 2016 14:52:04 GMT

Hello,

I'm struggling to get the "Network Access:ISE Host Name EQUALS <ISEHOSTNAME>" condition to work fur Guest Portal Redundancy.

I understand it is case sensitive and I have tried Match and Contain but still it does not match.

Read through this document, ISE with Static Redirect for Isolated Guest Networks Configuration Example - Cisco

with no joy.

Re: Network Access:ISE Host Name Condition

Timothy Abbott — Tue, 22 Nov 2016 15:50:32 GMT

Hi,

Could you try “Starts With” and see if it matches?

Regards,

-Tim

Re: Network Access:ISE Host Name Condition

joshhunter — Tue, 22 Nov 2016 15:55:01 GMT

Hi Tim, I tried this too and no joy.

It is only a 2 node deployment and is definitely the correct node as I can see it in the Live Authentication details tab for client as Policy Server.

Re: Network Access:ISE Host Name Condition

Timothy Abbott — Tue, 22 Nov 2016 16:06:08 GMT

Which version of ISE are you using?

Regards,

-Tim

Re: Network Access:ISE Host Name Condition

joshhunter — Tue, 22 Nov 2016 16:12:50 GMT

Very latest 2.1 Patch 1 (2.1.0.474) Patch 1

Re: Network Access:ISE Host Name Condition

hslai — Mon, 05 Dec 2016 05:49:48 GMT

Did you test it working with an earlier ISE release?

You may DEBUG on epm-pdp, epm-pip, and nsf-session, and then check ise-psc.log

Re: Network Access:ISE Host Name Condition

joshhunter — Mon, 12 Dec 2016 11:06:09 GMT

Hi Hslai, I received the debugs logs and I could see it was picking up the correct Authorization Policy.

I then went back to the RADIUS live logs and I could see again it was picking up the correct Authorization Policy.

So it is working , perhaps I was mistaking it for Authorization Profile name which is same as the old/duplicate rule.

Just to confirm I am using an attirbute of Network Access: ISE Hostname Equals <ISE HOSTNAME CASE SENSITVE>

Thanks

Re: Network Access:ISE Host Name Condition

Thibault BRISSE — Thu, 02 Feb 2017 17:04:41 GMT

Hi,

Same problem, the condition ISE Hostname Equals <ISE HOSTNAME CASE SENSITVE> works for only one ISE but not for the other one.

It doesn't work with ISE 2.1 patch 2 neither.

Re: Network Access:ISE Host Name Condition

hslai — Thu, 02 Feb 2017 19:00:09 GMT

Please open a TAC case if the setup is for production or customers'. In case it's your lab, please share debug log snippets and more details on

works for only one ISE but not for the other one.

Re: Network Access:ISE Host Name Condition

joshhunter — Thu, 02 Feb 2017 19:05:21 GMT

Hi Thiabault, this actually worked fine for me in the end.

I had reviewed the RADIUS Live Logs incorrectly, it was actually hitting the correct Authorization Rule for ISE2, I was reading the logs wrongly and mistaking the Authentication Rule as being the Authz rule.

If this is for Guest WLC make sure you specific the correct PSN (RADIUS) server configured on your Guest Wireless SSID.

Also use the details tab under via RADIUS Live Logs for more information.

Thanks.