topic Re: Multiply access levels based on posture conditions in Network Access Control

Multiply access levels based on posture conditions

sergey.dibrov — Tue, 07 Sep 2021 06:57:23 GMT

Hello, team.

Is it posible to create multiply level of Autorization based on Compliance conditions:

if endpoint mets all requiments - full complience - - assign profile FULL

if endpoint mets requiment 1 only - assign profile LIMIT

How to realese this hierarhy access?

We use ISE 3.1.0

Re: Multiply access levels based on posture conditions

balaji.bandi — Tue, 07 Sep 2021 08:28:05 GMT

Hope that should not be possible i guess. (typo issu) - worth looking below documents and limitations.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/210523-ISE-posture-style-comparison-for-pre-and.html

https://ciscocustomer.lookbookhq.com/iseguidedjourney/ISE-design-endpoint-attributes

Re: Multiply access levels based on posture conditions

Mohammed al Baqari — Tue, 07 Sep 2021 07:35:06 GMT

Hi,

I don't think this is possible. The compliance module will validate all
configured requirements for all matching posture policies and the result
will be compliant , non-compliant or unknown. If one condition is not
matched it will be non-compliance.

Try to raise this as an enhancement request with your account management
for a more granular posture results. Otherwise, having more conditions in
policy set instead of just posture status.

**** please remember to rate useful posts