topic Dot1x ISE policy in Network Access Control

Dot1x ISE policy

michael18 — Fri, 28 Jun 2024 09:30:29 GMT

Im building two Dot1x policies in ISE. One wired, the other wireless. As the end devices are the same and can connect either wired or wireless, the only difference in the policy is the wired or wireless dot1x condition selected from Condition Studio. However, when either wired or wireless connect they are using the wired policy as its the first policy.

Why is the wireless device hitting the wired policy if only wired_802.1x condition is set?

Re: Dot1x ISE policy

MHM Cisco World — Fri, 28 Jun 2024 10:13:33 GMT

can I see screen shoot of policy set

MHM

Re: Dot1x ISE policy

michael18 — Fri, 28 Jun 2024 12:23:56 GMT

screen shot attached.

thanks

Re: Dot1x ISE policy

michael18 — Fri, 28 Jun 2024 12:33:34 GMT

in this screen i see its using wired-dot1x policy from a wireless device. NAS is the WLC

Re: Dot1x ISE policy

Rob Ingram — Fri, 28 Jun 2024 13:49:42 GMT

@michael18

The connection is processed by the Wired-Dot1x Policy Set because you are currently matching on username starts with "host/" (albeit that rule appears to be currently disabled). Subsequently, the wireless connection is matching on the "Wired-Dot1x > Default" Authentication Policy because it's not a Wired authentication. Set the condition on the Policy Set itself to be "Wired_802.1X" only if you want only Wired 802.1X connections processed by that policy set.

Then make sure in your Wireless Policy Set you match on the condition "Wireless_802.1X"

Re: Dot1x ISE policy

Dustin Anderson — Fri, 28 Jun 2024 14:23:01 GMT

Is there a reason you are not using the wired/wireless conditions in the policy set vs the rule?

You have to think of ISE like a firewall, the conditions at the start will drop them into that policy set and run the rules. Since you are calling the host name only it will hit weather wired or wireless.

Re: Dot1x ISE policy

michael18 — Fri, 28 Jun 2024 14:39:29 GMT

Aw of course. That makes sense now you point it out.

thanks

Re: Dot1x ISE policy

michael18 — Mon, 01 Jul 2024 07:07:21 GMT

Hi Dustan

just lack of experience, following guides and videos. There seems to be many ways to build ISE policies but I do see the benefit in the way you set it out. Its given me a bit to think about going forward.

Thanks