topic Re: How to use active directory “extension Attribute” in ISE policy in Network Access Control

How to use active directory “extension Attribute” in ISE policy

JustTakeTheFirstStep — Wed, 12 Feb 2025 03:03:02 GMT

We want to create a policy set in ISE from an extension Attribute value in AD.

Can we use that attribute in the Policy Condition in ISE?

Any ideas?

Re: How to use active directory “extension Attribute” in ISE policy

Arne Bier — Wed, 12 Feb 2025 03:23:57 GMT

Have you had a look in your AD joined ISE? You can easily check this by navigating to Administration > Identity Management and then clicking on your AD Join Point. Open the 'Attributes' tab and then click 'Add'

Then I tend to select the option 'Select Attributes from directory' and give it a username as an example. I don't know if these extensions should exist in my AD - but I don't see them. Maybe you see them in your ISE.

Failing that, you can also bind ISE to your AD controllers using LDAP and then you will have complete access to all the objects.

Re: How to use active directory “extension Attribute” in ISE policy

JustTakeTheFirstStep — Wed, 12 Feb 2025 03:40:26 GMT

Okay. How do i then use that attribute as a condition in an authorization policy?

Re: How to use active directory “extension Attribute” in ISE policy

Arne Bier — Wed, 12 Feb 2025 04:50:02 GMT

Edit/create the Rule, and then click on the Conditions field to open up the Editor

You can search in the AD Join Points. Under the Dictionary drop-down, look for you AD Join Point name - e.g.

Re: How to use active directory “extension Attribute” in ISE policy

JustTakeTheFirstStep — Tue, 11 Mar 2025 04:45:44 GMT