ISE policy set (Machine+user)

ibrahim_hassan — Mon, 11 Mar 2019 05:46:02 GMT

Is there any way to create authorization rule that combine both machine and user identity groups in one rule?

for example, authorization profile match only if computer in external identity X and username in external identity group Y.

Sure, we commonly use EAP

Marvin Rhoads — Sun, 31 May 2015 17:39:49 GMT

Sure, we commonly use EAP chaining to address this use case. Please see "HowTo: EAP Chaining Deployment Configurations" on the ISE Design Guide page.

Specifically see the section beginning on page 15 which describes:

In this example, these rules will be defined based on the EAP-Chaining results:

• If both user and machine both succeeded

• If user succeeded and machine failed

• No chaining is supported