topic Re: Cisco ISE - Creating complex policy set rules in Network Access Control

Cisco ISE - Creating complex policy set rules

Marc0 — Wed, 12 Jan 2022 13:07:28 GMT

Hi All

I have ISE 2.7 and trying to create policy set rules in line with 802.1x rollout which is fairly straight forward.

However, im trying to find out if ISE will allow the creation of a single authorization policy rule with multiple conditions rules but mapping them to multiple results profiles?

Does anyone know if this is possible and If so, are there instructions on on doing this?

Thanks in advance

Re: Cisco ISE - Creating complex policy set rules

Marcelo Morais — Wed, 12 Jan 2022 15:06:09 GMT

Hi @Marc0 ,

something like this:

Hope this helps !!!

Re: Cisco ISE - Creating complex policy set rules

Marc0 — Wed, 12 Jan 2022 16:43:00 GMT

Hi Marcelo

Yes thats it, so can create but curious to understand how the condition rules link to the correct result profile when have multiple selected. Ive uploaded an example that we are trying to build

Re: Cisco ISE - Creating complex policy set rules

Greg Gibbs — Wed, 12 Jan 2022 23:47:52 GMT

See a related discussion here - Authorization permissions in one or multiple authorization profiles

When you 'stack' AuthZ Profiles, they are all applied to the session so you want to ensure there are no overlapping attributes (dACL, dVLAN, etc) as there is no way to specify the order in which they are applied.

For your example, both AuthZ Profiles would be applied to any session that matches any of your OR conditions.

I've personally never stacked AuthZ Profiles on any customer deployments as I feel they add more complexity rather than reducing it.

Re: Cisco ISE - Creating complex policy set rules

Marc0 — Thu, 13 Jan 2022 08:28:18 GMT

Thanks Greg for the response.

So if the view is not to stack the AuthZ profiles, is there a limitation on the number of AuthZ profiles that can be held in one policy set rule?

Re: Cisco ISE - Creating complex policy set rules

Greg Gibbs — Thu, 13 Jan 2022 21:55:42 GMT

As per the Scalability Guide... "It is not recommended to have more than 600 authorization rules in a single policy set"

If you have a 1:1 ratio of AuthZ Profiles to AuthZ Policy rules, the recommended max AuthZ Profiles per Policy Set would also be 600.