topic Re: DACL is not applied well in ISE. in Network Access Control

DACL is not applied well in ISE.

JustTakeTheFirstStep — Tue, 28 Apr 2020 07:13:46 GMT

DACL is not applied well in ISE.

I configured dACL as above.

However, you can ping anywhere.

If you look at the log, it appears that dACL is applied.

What is the problem ??

Re: DACL is not applied well in ISE.

Arne Bier — Tue, 28 Apr 2020 09:51:00 GMT

Have you checked the status of the session on the switch? Are you sure the dACL has been downloaded?

Re: DACL is not applied well in ISE.

JustTakeTheFirstStep — Tue, 28 Apr 2020 10:05:15 GMT

The switch is not registered with ISE.

WLC-ISE environment.

I want to control clients with ACLs in a wireless environment.

Re: DACL is not applied well in ISE.

Arne Bier — Tue, 28 Apr 2020 10:40:24 GMT

Is this a Cat 9800 WLC? In that case I don’t know much about it because it’s IOS-XE based.

But in the classic AireOS there is no dACL. The ACL lives on the WLC and RADIUS only sends the ACL name in the Access-Accept.

Re: DACL is not applied well in ISE.

Mike.Cifelli — Tue, 28 Apr 2020 12:39:14 GMT

I agree with @Arne Bier . In regard to AireOS you configure the ACLs on the controller. I know on the 5520 WLC this can be found under security->access control lists. Then reference which specific airespace acl in the respective authz profile.

Re: DACL is not applied well in ISE.

JustTakeTheFirstStep — Mon, 04 May 2020 05:36:15 GMT

Our controller is WLC5520.

Is it incorrect to use ISE dACL in ISE-WLC-AP configuration ??

I am currently importing WLC's ACL from ISE using the AirSpace_ACL function.

Re: DACL is not applied well in ISE.

Arne Bier — Mon, 04 May 2020 12:10:42 GMT

Hi @JustTakeTheFirstStep

dACL is only used in Cisco LAN Switches - not Cisco WLAN Controller (at least, not on the "legacy" AireOS stuff like your 5520)

The principle here is that you must configure all the ACLs on the 5520 itself. e.g. if the WLAN is centrally switched, then it's under Security > ACLs (somethig like that) - beware that for FlexConnect you must choose the Flex ACL (because the ACLs then get applied on the APs themselves, and not on the Central Controller).

ISE's job is to send the ACL Name to the WLC during the Access-Accept. That applies the ACL for that Session. Make sure the name in the ISE Result is identical to that configured on the WLC