topic Re: Calling logical profiles in ISE 2.2 in Network Access Control

Calling logical profiles in ISE 2.2

dgaikwad — Mon, 02 Mar 2020 12:32:02 GMT

Hi Experts,
I am using ISE 2.2.0.470 with patch 16

I have created a few profiling policies to segregate laptops, and then called them in logical profile as corporate laptops.
Using this logical profile I want to run a few posture policies only for laptops.
But, now I am stuck, as I am not able to call this logical profile inside my posture policy.
I can see that there is something called as NAC_Profiler, is that similar to endpoint groups or logical profiles?

If calling logical profiles is not possible then, is it possible to move the endpoint groups that are created by profiling policies to under some other parent groups, such as Registered endpoints, as I can see that is populating in posture policy here:

Is this something which is limited by the design or there is any workaround that I should be looking at?

Re: Calling logical profiles in ISE 2.2

Mike.Cifelli — Mon, 02 Mar 2020 18:21:30 GMT

You can call the logical profiled group under 'other conditions'. For example it would look like this:
Rule 1: If ANY and Windows All and Endpoints:LogicalProfile EQUALS Cameras then <result>
HTH!

Re: Calling logical profiles in ISE 2.2

dgaikwad — Tue, 03 Mar 2020 05:47:32 GMT

I am under the other conditions in posture polices, but the endpoints is not listed here...

As here the endpoints is not visible under it, where as its listed under authorization policies.
Now the question is, is this something that is supported in this version of ISE?

Re: Calling logical profiles in ISE 2.2

Mike.Cifelli — Tue, 03 Mar 2020 13:57:59 GMT

Go to Policy->Policy Elements->Conditions->Dictionary Simple Condition. Add new Condition that looks like this:
Name = <name>
Attribute = Endpoints:LogicalProfile
Operator = EQUALS
Value = <logical group>
Then go back to posture policies->Other conditions (select)->Existing Simple condition-><your created logical group condition>
HTH!

Re: Calling logical profiles in ISE 2.2

Greg Gibbs — Tue, 03 Mar 2020 22:23:48 GMT

ISE 2.2 does not support those matching conditions in Posture or Client Provisioning Policies. The ability to match on these conditions was not added until ISE 2.3+ as per the Release Notes.