topic Re: Authorization policies - Using multiple authorization profiles in Network Access Control

Authorization policies - Using multiple authorization profiles

dgaikwad — Thu, 24 Mar 2022 05:55:55 GMT

Hi Experts,

Running ISE 3.1 patch 1.

Is it possible to have multiple authorization profiles in results with a single authorization policy?
And if multiple profiles are added, which profile will take precedence?

Re: Authorization policies - Using multiple authorization profiles

Octavian Szolga — Thu, 24 Mar 2022 09:30:10 GMT

Hi,

This is not recommended because it will give you headaches 🙂

Technically it's possible. My guess is that your two profiles will be combined, except the case when the same attribute is defined in both profiles.

BR,

Octavian

Re: Authorization policies - Using multiple authorization profiles

dgaikwad — Thu, 24 Mar 2022 11:16:07 GMT

Thanks for the confirmation, I was thinking on the same lines.
Thus they can be used, but the effects are not going to be good if combined.

Thus there could be two authz profiles with two different DACLs and they will combined and applied, right?

Re: Authorization policies - Using multiple authorization profiles

Octavian Szolga — Thu, 24 Mar 2022 11:24:18 GMT

Hi,

As far as I know, dACLs will not be combined.

BR,

Octavian

Re: Authorization policies - Using multiple authorization profiles

Mike.Cifelli — Thu, 24 Mar 2022 13:49:20 GMT

And if multiple profiles are added, which profile will take precedence?

-If multiple authz profiles are assigned as result they will be combined and assigned to the session. You can see this via radius live log for the test session. In the live log pay attention to Authorization Result which is found under 'Overview'. to see which multiple authz profiles are assigned to session. Then at the bottom under 'Result' you will see the applied attributes to the session which will show you that the two are combined and applied. Should there be identical attributes configured in both I am pretty sure that the first match will take and be assigned. Lastly, this may assist: ISE Authentication and Authorization Policy Reference - Cisco Community

Re: Authorization policies - Using multiple authorization profiles

marco.merlo — Mon, 16 Jan 2023 17:28:27 GMT

Hi mike,

what happens if I apply two different auth profiles at the same auth rule each of one refers to a specific device profile?

Would ise send just the correct device profile?

Regards

Marco

Re: Authorization policies - Using multiple authorization profiles

Karsten Iwen — Mon, 16 Jan 2023 17:57:22 GMT

I use it quite often this way as it gives you a great flexibility *and* visibility if you do it the correct way. For example, I have AuthZ profiles that *only* include the assigned VLAN, these have the prefix "VLan_", the AuthZ profiles that include a DACL have the prefix "DACL_" and so on and so on. I didn't count them but I think that in the end the total amount of AuthZ profiles is reduced and the visibility in the AuthZ policy is greatly improved as I directly see what I send to the NAD.