topic Re: Push two authorization profiles in one authorization policy in Network Access Control

Push two authorization profiles in one authorization policy

dgaikwad — Mon, 11 Mar 2019 08:55:13 GMT

Hello Experts,
I am running ISE 2.4 with patch 4.
In the authorization policy is it possible to push two authorization profiles?
If yes, then which ones will take the precedence?
Or is this something that the design of ISE does not allow?

Any pointers or documentation to achieve this?

Re: Push two authorization profiles in one authorization policy

Mohammed al Baqari — Fri, 08 Feb 2019 09:42:20 GMT

No you can't combine two profiles in one rule. With the profile you can
combination of ands and ors nested

Re: Push two authorization profiles in one authorization policy

Damien Miller — Fri, 08 Feb 2019 16:24:59 GMT

I think you might get more helpful advise if you were to try and explain why you think you need two authorization results. To clarify the terms, I'm assuming authorization results because that's what ise would send back to the switch/wlc. As indicated in the previous post, it's not possible, but there are usually ways to accomplish most rule requirements.

Re: Push two authorization profiles in one authorization policy

hslai — Sat, 09 Feb 2019 23:40:17 GMT

If the matched authz policy rule has multiple profiles. They are combined in such way that distinct attributes will all apply and the first values of the same attributes will apply.

For example, the following rule has three authz profiles:

dACL PermitALL -- with the attribute for DACL -- PERMIT_ALL
vlan 100 -- with the common task VLAN set to 100
vlan 101 -- with the common task VLAN set to 101

As the DACL is unique and VLAN assignments are duplicated, the resulting permissions would have DACL PERMIT_ALL and the first VLAN assignment, which set to 100.

Re: Push two authorization profiles in one authorization policy

dgaikwad — Mon, 11 Feb 2019 10:27:44 GMT

I was thinking about a use case, where the WLC has ACL has a limitation of 64 lines in single ACL. So, what if I create multiple dACL and push them via authorization profiles, thus increasing the overall capacity.

Re: Push two authorization profiles in one authorization policy

bern81 — Mon, 11 Feb 2019 12:17:55 GMT

Hi,
I know this is not directly related to your question but I don't think you can push DACL to WLC, you can create ACL locally on the WLC and call it by its name in the Authorization profile via "airspace ACL" option.

Re: Push two authorization profiles in one authorization policy

hslai — Mon, 11 Feb 2019 14:59:20 GMT

bern81 is correct that WLC not using DACL. If needing many ACEs, then you should consider another solution (e.g. ASA) to perform the enforcement.

Re: Push two authorization profiles in one authorization policy

dgaikwad — Tue, 12 Feb 2019 07:47:17 GMT

Well, that makes sense...

Thank you for all the inputs...