https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4465333#M1083621 <P><a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1190993">@Leftz</a> I generally use policy set conditions to distinguish between different connection scenarios, such as 802.1x Open Mode or 802.1x Closed More or Remote Access VPN etc. In a large complex environment, without having multiple Policy Sets you could have a overly complex Policy Set. By using multiple Policy Sets if the connection does not match the condition configured under the Policy Set, it will completely skip that Policy Set until it matches another, at which point it will process the associated authentication and authorisation rules. Depending on the size of your environment, using multiple Policy Sets will speed up the authentication/authorisation process.</P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 13 Sep 2021 20:57:19 GMT Rob Ingram 2021-09-13T20:57:19Z https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4465320#M1083619 <P>Hi&nbsp;</P><P>We know Policy set is a container containing authentication and authorization rules etc. each authentication and authorization policy also has Conditions option for us to fill out, but Policy Set also has Condition option that we use to define. How does this Policy set Condition work? Do you think Policy set condition is&nbsp; necessary?</P> Mon, 13 Sep 2021 20:23:11 GMT https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4465320#M1083619 Leftz 2021-09-13T20:23:11Z https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4465333#M1083621 <P><a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1190993">@Leftz</a> I generally use policy set conditions to distinguish between different connection scenarios, such as 802.1x Open Mode or 802.1x Closed More or Remote Access VPN etc. In a large complex environment, without having multiple Policy Sets you could have a overly complex Policy Set. By using multiple Policy Sets if the connection does not match the condition configured under the Policy Set, it will completely skip that Policy Set until it matches another, at which point it will process the associated authentication and authorisation rules. Depending on the size of your environment, using multiple Policy Sets will speed up the authentication/authorisation process.</P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 13 Sep 2021 20:57:19 GMT https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4465333#M1083621 Rob Ingram 2021-09-13T20:57:19Z https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4466174#M1083642 <P>Thank you Rob! Can I say in some situation, the condition in Policy set is not required?&nbsp;</P> Tue, 14 Sep 2021 14:08:29 GMT https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4466174#M1083642 Leftz 2021-09-14T14:08:29Z https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4466181#M1083643 <P><a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1190993">@Leftz</a> you don't need a condition on the default policy set. If you have more than one policy set you will need a unique condition to differentiate between the 2 policy sets.</P> Tue, 14 Sep 2021 14:18:38 GMT https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4466181#M1083643 Rob Ingram 2021-09-14T14:18:38Z https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4467177#M1083707 <P>Understood. Thank you Rob!</P> Wed, 15 Sep 2021 19:08:53 GMT https://community.cisco.com/t5/network-security/policy-set-function-on-authentication-and-authorization/m-p/4467177#M1083707 Leftz 2021-09-15T19:08:53Z