topic Re: ISE Posture with static addressing in Network Access Control

ISE Posture with static addressing

iVicMMac — Fri, 06 May 2022 00:51:14 GMT

Hello Team,

I'm struggling configuring the posture for +600 users with static addressing (this addressing is assigned by ISE) I can't make the ISE applies the iP address for each user plus works the ISE Posture at the same time within my policy, anyone can help me?

CISCO ISE 2.4

Re: ISE Posture with static addressing

ahollifield — Fri, 06 May 2022 01:22:56 GMT

So you are using the ISE local DHCP server? How is ISE assigning static IPs to clients? IP Device Tracking enabled on the NAD?

Re: ISE Posture with static addressing

iVicMMac — Fri, 06 May 2022 02:14:02 GMT

Nope, all the addressing is static, no DHCP, I created each autorization profile with each framed iP, so this profile is the iP the user receives

Re: ISE Posture with static addressing

ahollifield — Fri, 06 May 2022 11:22:41 GMT

Interesting. What is the use-case here? So you have 600 AuthZ profiles? One for each user?

Re: ISE Posture with static addressing

iVicMMac — Sat, 07 May 2022 11:30:48 GMT

Yes, its a customer requirement to have more control over the users

Re: ISE Posture with static addressing

Marcelo Morais — Sun, 08 May 2022 01:37:23 GMT

Hi @iVicMMac ,

if my understanding is correct, you would like not only to use the IP Addr of the Device as a Condition to the Authorization Policy, but also check the Posture status, please try the following (as an example):

At Policy > Policy Set, you created a Wired-Policy, for ex.:

Authorization Policy

Rule Name: John-Doe-AuthZPolicy-Compliant

Condition: Network Access.Device IP Address Equals 10.10.10.1 AND Session.PostureStatus Equals Compliant

Result: <AuthZ Profiles Result for Posture Compliant>

Rule Name: John-Doe-AuthZPolicy-Unknown

Condition: Network Access.Device IP Address Equals 10.10.10.1 AND Session.PostureStatus Equals Unknown

Result: <AuthZ Profiles Result for Posture Unknown>

Hope this helps !!!

Re: ISE Posture with static addressing

iVicMMac — Mon, 09 May 2022 17:08:07 GMT

Thank you Marcelo,

I tried a solution pretty similar last week and it seems is working 😉 The difference is I configured only 1 policy for compliant and noncompliant at the end of policy set and the unknown condition for each user, a lot of work to add manually this condition but its ok. Thank you again.

Regards,