topic Re: Cisco ISE Policy Set for a specific switchport in Network Security

Cisco ISE Policy Set for a specific switchport

Anthony O'Reilly — Mon, 21 Jun 2021 15:10:08 GMT

Hi,

I've rolled out dot1x via Cisco ISE onto a customer user network. The user access switches are 2960X. The version of ISE is 2.7 Patch 2.

There are a few issues, specifically with a group of users. I want to created a new policy set for one user in particular and put this policy above the policy for everyone else. I want the policy to do the same as the working policy except for it to only allow a specific network port e.g. Switch5, interface Gi3/0/30. For here, they will get a test dACL that I will use for testing purposes

I have configured the following and enabled it but the user is still authenticating against the all users policy.

Unclassified : Normalised Radius : Radius Flow Type equals Wired802.1x

Network Device : Network Access : NetworkDeviceName equals switch5

Port : Radius : NAS-Port-ID equals Gi3/0/30

I hope all this makes sense. I've attached a few screenshot for clarification.

Thanks

Anthony.

Re: Cisco ISE Policy Set for a specific switchport

Marius Gunnerud — Mon, 21 Jun 2021 22:28:45 GMT

Since these two policies are doing the exact same thing (except for the dACL) could you remove the nas-port-id condition (and the dACL) to verify that you are matching on the device name. If this match is successful, then we know that the issue is with the port id.

Re: Cisco ISE Policy Set for a specific switchport

Anthony O'Reilly — Thu, 24 Jun 2021 08:18:02 GMT

I removed the nas-port-id and found that it was the NAD device in ISE that was configured with a different name to the real switch name (embarrassing). Thanks for your help.