topic Re: ISE3.1 network device groups hierarchy in Network Access Control

ISE3.1 network device groups hierarchy

EHNET — Thu, 23 Feb 2023 23:23:11 GMT

Hi, I am new to ISE and try to implement it. But I am confused by the hierarchy of NDGs

For example, I created a parent group called Building A using All locations as root group.

And then I created two child groups of Building A, called them floor 1 and 2, added one device to each child group.

But if I write a condition in policy set to match parent group, Building A, it wont match any devices included in its child group. Is it supposed to work like this way ? or I used it wrong ?

And as shown in the picture, the group numbers for Building A is 0. Why this number does not include all its children group devices ?

Re: ISE3.1 network device groups hierarchy

Greg Gibbs — Thu, 23 Feb 2023 23:34:45 GMT

That is working as designed. If you want to create a matching condition for all devices under the 'Building A' parent group, you would use 'DEVICE·Location STARTS WITH All Locations#Building A'

Re: ISE3.1 network device groups hierarchy

EHNET — Thu, 23 Feb 2023 23:38:21 GMT

Thanks for your prompt response, I will try that.

But as for the group member count, the parent group is not the sum of its child group ?

Re: ISE3.1 network device groups hierarchy

Rodrigo Diaz — Fri, 24 Feb 2023 00:09:12 GMT

hello @EHNET in which version of ISE are you seeing that behavior ? what happen if you click on the 0 that is in front of Network device group Building A ?

Re: ISE3.1 network device groups hierarchy

Charlie Moreton — Fri, 24 Feb 2023 13:16:08 GMT

@EHNET , no the group member count is for devices, not subgroups. Since there are no devices in the group All Locations#BuildingA, the count is 0. All Locations#BuildingA#Floor1 contains 1 and All Locations#BuildingA#Floor2 contains 1.

@greg is right, choose the Starts with condition and select All Locations#BuildingA to select all floors within that building.

Re: ISE3.1 network device groups hierarchy

EHNET — Fri, 24 Feb 2023 20:15:39 GMT

Right, I know group member count is for devices not subgroups.

But ISE doesn't work in this way. When I click that parent number, it shows 0 devices in the parent group. I think it should be the sum of all its child group and the count should be 8, right ?

I am on ADE-OS Version 3.1.0.135

Re: ISE3.1 network device groups hierarchy

EHNET — Fri, 24 Feb 2023 17:58:45 GMT

I am on ADE-OS Version 3.1.0.135. Please see my screen capture in another reply