็How can configure ISE for FIX 2 IP for 1 Users

[jewfcb001]

Hi All ,

I try to configure Cisco ISE Static IP for User VPN(User Custom Attributes) . It's working fine . But  If I need to configure fix 2 IP Address for 1 User .I'm not sure how can do it for this situation and condition on Cisco ISE. 

Please advise me .

[Arne Bier]

@jewfcb001 - how does this work in theory? What is the 2nd IP address used for? Can you give more details about this?

As you already found out, you can return custom attributes when internal ISE users are authenticated. The question I have is

• Does this user always need 2 fixed IP addresses?
• or ... do you need to assign a different IP address for the same user, but under different conditions? (e.g. user bob needs IP:10.10.10.1 when connecting from location A, and IP: 20.20.20.1 when connecting from location B)

[jewfcb001]

@Arne Bier 

or ... do you need to assign a different IP address for the same user, but under different conditions? (e.g. user bob needs IP:10.10.10.1 when connecting from location A, and IP: 20.20.20.1 when connecting from location B

    Yes , It's my objective. I found user custom attributes and I can configure many attribute for Static  IP address . I think I can use this option for my objective and configure this option on authorization for seperate location.. Please advise me again .

 

[Arne Bier]

Sadly ISE is not flexible in that way. If the user is successfully authenticated, then ISE will make those custom attributes available to you in your Authorization Profile - but you cannot be conditional about it.

One way around this would be to create two Authorization Rules with matching Authorization Profiles - and then to return the correct Authorization Profile depending on the Authorization logic that you're using. Is that scalable for you?

Example Authorization Profile below (which returns both IPs - of course this is non-sensical - the NAS can only handle (the last) one)

[jewfcb001]

@Arne Bier 

 I will use 2 authorize profile and use NAS condition for seperate Static IP. 

what do you think? Is it possible ?

[Arne Bier · Accepted solution]

Definitely

Create two Authorization Profiles, which include the custom IP address attributes (and anything else you need)

Authorization Profile VPN_NAS1:

And the other one - VPN_NAS2:

And then use them in the Authorization Policy

[jewfcb001]

@Arne Bier 

Thank you for the answer . I will try in my lab . I think this solution good for me .