Nested Endpoint Identity Groups - What for?

Arne Bier — Mon, 02 Jun 2025 04:44:59 GMT

Hello,

I like the idea of creating EIG (Endpoint Identity Groups) in a hierarchical fashion, but I have run into a limitation - wondering if there is a solution for this.

If you create an EIG Hierarchy as follows:

Parent 1
Parent 2

and under each Parent, create a Child 1 Endpoint Identity Group, so that the result looks like this:

Parent 1
  Child 1
Parent 2
  Child 1

then you can create RADIUS Policy Set rules that refer to each Parent:Child relationship (where the semicolon is the delimiter) as

"Parent 1:Child 1"

"Parent 2:Child 1"

However, in Context Visibility, you cannot tell who the parent is when an endpoint is assigned as "Child 1" of either parent - that level of granularity is not available. In Context Visibility, you can statically set an EIG, but in the drop-down list, the options appear as

Child 1
Child 1

No context about the parent.

In the Context Visibility Browser, you don't see the Parent details either, and even worse, in the CSV import, there is no way to be specific about the exact Parent:Child relationship- you can only specify an EIG name - who knows where the endpoint will be assigned to...

So is it a bug, or just lacking feature support in ISE ? Why allow hierarchical nesting of groups, when the implications of using such a feature makes it very hard (or pointless) in practice?

Re: Nested Endpoint Identity Groups - What for?

Marcelo Morais — Mon, 02 Jun 2025 05:26:49 GMT

Hi @Arne Bier ,

I totally agree !!!

For me is "just lacking feature support in ISE" ... as a workaround, what I do is something like this:

Parent 1
  P1-Child 1
Parent 2
  P2-Child 1

Best regards

Re: Nested Endpoint Identity Groups - What for?

Arne Bier — Mon, 02 Jun 2025 05:36:58 GMT

@Marcelo Morais that's a great workaround - your naming conventions allows me to create the hierarchy in "Administration / Identity Management / Endpoint Identity Groups" screen to collapse the Groups under their parents. I like that! Thanks

topic Re: Nested Endpoint Identity Groups - What for? in Network Access Control

Nested Endpoint Identity Groups - What for?

Re: Nested Endpoint Identity Groups - What for?

Re: Nested Endpoint Identity Groups - What for?