TrustSec - Dynamic IP Pool

[Xividar]

Hi Guys,

I need to dynamically drop a user in to a particular VN / IP Pool, I have created my Authorization Policy within ISE, and under Common Tasks, selected Security Group, and then set my SGT, VN, Type, and IP Pool - when the user logs in, I can see the Profile getting applied, however, it does not seem to update the port on the switch. Using the VLAN / VLAN ID method does appear to work.

I have seen the Security Group method on some slides, so it appears to be supported.

Thanks for help in advanced.

[jedolphi]

Hi. It's a wired endpoint I assume? Both methods should work, if they don't you can raise a TAC case or share some more debugging information here. The CLI on Fabric Edge "test aaa group radius <username> <password> new-code" should give some clues. Also if the switch is not too busy with users you could try and connect a new endpoint while "debug radius" is running on the Fabric Edge. Cheers, Jerome