topic Cisco ISE two or more Authentication Policy Result in Network Access Control

Cisco ISE two or more Authentication Policy Result

Americo Massotti — Tue, 16 Mar 2021 11:32:25 GMT

Hello guys.

I would ask you the logic of have two o more Authentication Policy Result for a policy set's rule.

I mean, sometimes I saw on different Cisco ISE policy sets some policy set rules that has two or more result for the same conditions.

So, in which way ISE apply one or the other? for my understanding the condition are the same.

Thanks a lot.

Americo

Re: Cisco ISE two or more Authentication Policy Result

Marcelo Morais — Tue, 16 Mar 2021 13:35:08 GMT

Hi @Americo Massotti

please take a look at: ISE Admin Guide - Policy Set.

Remember that:

"... Policy sets are configured hierarchically, where the rule on the top level of the policy set, which can be viewed from the Policy Set table, applies to the entire set and is matched before the rules for the rest of the policies and exceptions. Thereafter, rules of the set are applied in this order:

Authentication policy rules
Local policy exceptions
Global policy exceptions
Authorization policy rules..."

Hope this helps !!!

Re: Cisco ISE two or more Authentication Policy Result

hslai — Wed, 17 Mar 2021 03:31:44 GMT

If more than one authorization profiles in the same result cell, then the attributes would be combined but only the first value will apply if the attribute may have only one. For example,

authzProfile-1: VLAN=Employees, DACL=permitALL

authzProfile-2: VLAN=ACCESS, Reauthentication with Timer=1800

SecureGroup=Employees

The combined shall be: VLAN=Employees, DACL=permitALL, Reauthentication with Timer=1800, SecureGroup=Employees