Hello Asif,
I have run many ISE implementations but I am not familiar with any ability to match multiple authorization rules. Typically you build ISE on a first match design. You can create multiple policy sets, each policy set will have authentication conditions that must be matched. Once you match an authentication rule in a policy set you then hit a configured authorization rule.
Within both the authentication rules and authorization rules of a policy set you can set up compound conditions. These conditions must be met to be matched.
It sounds like when you upgraded it might have merged your existing 2.2 policy set incorrectly, or in a way that doesn't match your needs. You shouldn't need to match two rules to authenticate the same endpoint.
