topic Re: Cisco ISE - hitting wrong NetworkDevice Group in Network Access Control

Cisco ISE - hitting wrong NetworkDevice Group

Netmart — Mon, 21 Jul 2025 22:51:44 GMT

Hello,

For some reason, an authentication request for node 172.23.140.200 is hitting the wrong Network Devices Group, though there is a long prefix/32 available. Consequently, the wrong Policy-Set is chosen with Privilege Level1.

Usually ISE is expected to hit the longest prefix

#1 Arista_mgmt: 172.23.140.200/32

#6: Private-172-Network1: 172.23.128.0/20

Jun 19 17:27:22 ISE-1 CISE_Passed_Authentications 0485078549 4 0 2025-06-19 17:27:22.220 -04:00 59105442473 5201

NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=71, Device IP Address=172.23.140.200,

DestinationIPAddress=******, DestinationPort=49, UserName=cvpadmin, Protocol=Tacacs, NetworkDeviceName=Private-172-Network1,

Type=Authentication, Action=Login, Privilege-Level=1,

Version:

3.1.0.518

Patch Information: 3

Any advice is much appreciated.

Re: Cisco ISE - hitting wrong NetworkDevice Group

ahollifield — Tue, 22 Jul 2025 19:32:06 GMT

3.1 patch 3 is very old at this point. I would not spend any time troubleshooting this issue until you upgrade to the latest 3.1 patch.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-1-3-2.html

Re: Cisco ISE - hitting wrong NetworkDevice Group

MHM Cisco World — Tue, 22 Jul 2025 20:01:47 GMT

Did you try change device profile under network device list ?

MHM

Re: Cisco ISE - hitting wrong NetworkDevice Group

Netmart — Wed, 23 Jul 2025 16:10:24 GMT

Thank you MHM.

Under Work Centers > Network Access > Network Devices: the IP is listed under Network Devices List.

I would appreciate, if you could please guide me where the device profile is linked to the network device list.

Please keep in mind that other IPs in the same Network Device List are hitting the proper policy [based on the logs].

Re: Cisco ISE - hitting wrong NetworkDevice Group

MHM Cisco World — Wed, 23 Jul 2025 16:40:57 GMT

I check cisco doc and other notes

Device profile not send as radius attribute so ISE can not use it to identify device.

Retrun to IP conflict'

ISE support range of IP so you can use range of IP to exclude single device IP from device group

I.e. 10.0.0.100/32 single

10.0.0.0/24 device group

In ISE add IP for device group as

10.0.0.1-10.0.0.99

10.0.0.101-10.0.0.254

Hope this help you to solve problem

MHM