topic Re: ISE per user policy map in Network Access Control

ISE per user policy map

peter.matuska1 — Mon, 06 Sep 2021 15:30:01 GMT

Hi,

ISE 2.7 with Catalyst 9300. I want to apply policy-map on an interface as a result of authorization. The goal is to limit the speed for the connected device to 15/15M.

Is it possible? What av-pair to use?

thank you

Re: ISE per user policy map

Mohammed al Baqari — Mon, 06 Sep 2021 15:46:06 GMT

Hi,

These attributes work for WLC but not sure about IOS. Try them from
authorization results > advanced attributes > radius. You can verify them
using show session interface x/x details and see what has been passed from
server policies.

Aire-Real-Time-Bandwidth-Average-UpStream-Contract
Aire-Data-Bandwidth-Average-DownStream-Contract
Aire-Data-Bandwidth-Burst-UpStream-Contract
Aire-Real-Time-Bandwidth-Burst-DownStream-Contract
Aire-Real-Time-Bandwidth-Average-DownStream-Contract
Aire-Real-Time-Bandwidth-Burst-UpStream-Contract
Aire-Data-Bandwidth-Average-UpStream-Contract
Aire-Data-Bandwidth-Burst-DownStream-Contract

**** please remember to rate useful posts

Re: ISE per user policy map

peter.matuska1 — Mon, 06 Sep 2021 17:39:17 GMT

thank you, but didn't work.

Re: ISE per user policy map

Mohammed al Baqari — Mon, 06 Sep 2021 18:08:06 GMT

I did some research and seems its possible on routers with ISG enabled
(usually service providers enviroments).

See below doc

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/isg/configuration/xe-3s/isg-xe-3s-book/isg-radius-pol.html

***** please remember to rate useful posts

Re: ISE per user policy map

Greg Gibbs — Tue, 07 Sep 2021 00:30:37 GMT

You might try this approach. I have not tested the traffic policing, but I have confirmed that the policy-map is applied in my lab.

Create an empty class-map (e.g. CLASS_POLICE) and a policy-map (e.g. POLICY_POLICE) on the switch as per this guide.

Create a new template (e.g. NAC_Police) on the switch with the same configuration as your NAC template (e.g. DefaultWiredDot1xOpenAuth) but with the added configuration of your Policing policy (service-policy input POLICY_POLICE).

In your ISE AuthZ Profile, enable the Common Task for 'Interface Template' and specify your new template name (NAC_Police).

Upon authZ, you should see the Interface Template applied to the session:

sw1#show access-sess interf gig0/x det 
            Interface:  GigabitEthernet0/x
<snip>
       Current Policy:  PMAP_DefaultWiredDot1xOpenAuth_1X_MAB

Server Policies:
<snip>
   Interface Template:  NAC_Police
              ACS ACL:  xACSACLx-IP-MM-DACL-AD-User-609cc325

You should also see the service-policy applied in the derived-config:

sw1#show derived-config int gig0/x
Building configuration...

Derived configuration : 507 bytes
!
interface GigabitEthernet0/x
<snip>
 service-policy type control subscriber PMAP_DefaultWiredDot1xOpenAuth_1X_MAB
 service-policy input POLICY_POLICE
end

Re: ISE per user policy map

peter.matuska1 — Wed, 08 Sep 2021 07:34:05 GMT

thank you. this worked.