topic Re: ISE V3.2 How can I change the Default Authentication Policy in Network Access Control

ISE V3.2 How can I change the Default Authentication Policy

Gehrig_W — Wed, 27 Nov 2024 08:36:51 GMT

Hello Cisco ISE experts,

I'm new to Cisco ISE V3.2 and I'm struggling with Policy Sets and the embedded "Default"- Authentication Policy.

To make the output of Radius Live Log more meaningful, I would like to replace the word "Default" in the according policy set with a more meaningful string like "MAC-Check Internal Endpoints".

But I cannot find the Editor Button for this within the Ruleset Editor page.

I have also tried to add a second Authentication Policy Rule with a more meaningful Rule Name in front of the "Default" Authentication Policy with same Use Parameters, but receive the following cryptic error-message in that case.

Internal Check of MAC-Address - could not be saved.
Rule Condition is not properly configured for rule: Internal Check of MAC-Address

Obviously I do not understand the concept behind this "Default" very well.

Who knows how I can substitute this sucking "Default" with a more meanful expression ?

Thank You in advance

Greetings from Frankonia

Wini

Prime V3.10.4 and ISE V.3.2 (formerly V2.4)

Re: ISE V3.2 How can I change the Default Authentication Policy

Greg Gibbs — Thu, 28 Nov 2024 02:31:57 GMT

You cannot change the name of the Default rule. You would need to create a rule above it that matches your session criteria.

The whole point of the Default rule is that it is the one hit when none of your specific configured rules are hit.

Re: ISE V3.2 How can I change the Default Authentication Policy

Gehrig_W — Fri, 29 Nov 2024 08:13:38 GMT

Hello Greg,

thank You for Your reply.

I already tried to create a rule above the default rule with meaningful title and same settings as the Default rule as You can see from my attached screenshot. Unfortunately I receive the following error-message:

Internal Check of MAC-Address - could not be saved.
Rule Condition is not properly configured for rule: Internal Check of MAC-Address

In the Cisco Press book for ISE I can see that initally there are three possible options here:

- MAB -Dot1x and -Default

Also the following Guide shows these three option in V2.4:

https://community.cisco.com/t5/security-knowledge-base/ise-authentication-and-authorization-policy-reference/ta-p/3850472#toc-hId-1207799424

How can I change from Default to MAB instead in an already defined ruleset ?

Thank You for Yor help

Kind regards

Wini

Re: ISE V3.2 How can I change the Default Authentication Policy

MHM Cisco World — Fri, 29 Nov 2024 08:37:35 GMT

can you share policy set

MHM

Re: ISE V3.2 How can I change the Default Authentication Policy

Gehrig_W — Fri, 29 Nov 2024 09:09:36 GMT

Hello Cisco ISE Support
how can I change the “Default” Authentication Policy within this Policy to a more meaningful Rule Name.
Wetalk about MAB Authnetication Bypass in this case and would like to use WLAN iPSK to allow IoT-devices to authenticate by checking their MAC-adresses.
[cid:image001.jpg@01DB4246.BC833160]

Thank You for Your help

Kind regards

Wini

Re: ISE V3.2 How can I change the Default Authentication Policy

MHM Cisco World — Fri, 29 Nov 2024 20:48:45 GMT

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/216130-configure-catalyst-9800-wlc-ipsk-with-ci.html

below how you can use ipsk,

we dont use MAB for ipsk we but we use mac in authz/authc policy

MHM

Re: ISE V3.2 How can I change the Default Authentication Policy

Peter Koltl — Sat, 30 Nov 2024 20:43:22 GMT

You cannot save the new rule without adding a condition. Try Wireless_MAB.