topic Re: Understanding Authorization Profiles in Network Access Control

Understanding Authorization Profiles

russell.sage — Thu, 24 Jun 2021 16:20:49 GMT

I have a customer solution that has an authorization profile to allow users who register their details access to the internet with their personal devices.

The attached screenshots show the policy works but I can't understand how.

there are no users in the identity group used in the profile.

The users registers via an internal website that communicates with ISE via REST API.

Re: Understanding Authorization Profiles

Nit in Net — Thu, 24 Jun 2021 22:11:36 GMT

In this case internal users creates on the internal website and during the time of authentication which will push to ise using API. its like an automated process.

Re: Understanding Authorization Profiles

thomas — Sun, 27 Jun 2021 22:16:59 GMT

This is your Policy Authorization Rule from your picture:

First condition matches on your SSID containing "MyInternet"

Second condition matches any ISE internal users in the group GuestType_MyInternet.

From your explanation, it sounds like you are adding guest users' Username and Password via REST API to the ISE internal identity group GuestType_MyInternet. This allows them to authenticate to SSID MyInternet so they can connect securely with PEAP rather than an open, unencrypted SSID. I figured this because even though you did not show your authentication policy, you named your Authorization Result "PEAP/PermitAccess".

To find out exactly Why it is working, simply look at the ISE LiveLogs and click on the 📄 details icon next to a Passed Authentication to see all of the details that ISE went through to authenticate and authorize that endpoint including the user, identity store, protocols, authorization result, etc.

Re: Understanding Authorization Profiles

russell.sage — Mon, 28 Jun 2021 07:35:49 GMT

Thomas

Thanks for the reply. I did look at the logs. It states it matched against the conditions in the screenshot. The point of my post was that when you look in the internal identity GuestType_MyInternet there are no entries as seen in the second screenshot. So how is it matching?