topic Re: ISE assign SGT base on AD Group in Network Access Control

ISE assign SGT base on AD Group

raymondluis13 — Fri, 07 Oct 2022 10:04:26 GMT

I have an ISE that connected to the AD. So, i want to assign the same group in AD (ip, devices, and all) to the SGT automatically. For example, if i have an IT group and HR group in AD, the ISE will automatically make SGT with the same group. And if the member of the group in AD is changing, the ISE will automatically change the SGT based on AD.

Re: ISE assign SGT base on AD Group

ahollifield — Fri, 07 Oct 2022 11:31:42 GMT

You can assign an SGT based on any authz profile in auth (which includes AD group). What is your question?

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

Re: ISE assign SGT base on AD Group

Aref Alsouqi — Fri, 07 Oct 2022 11:40:14 GMT

You can do that by selecting the SGT you want to assign to the users/devices from the "Security Groups" column in the "Authorization Policy" in the policy set. It is basically the column next to the profiles column where you assign the authorization profile. Obv, the SGTs should be created in advance, you can create them from the "TrustSec" section > Components > Security Groups.