Auth Failed, authorization -DenyAccess for a device. How can i quickly add these devices into the relevant identity group so that it can be authorized?

[getaway51]

Hi,

I view in ISE log and saw Auth Failed, authorization -DenyAccess for a device. How can i quickly add these devices into the relevant identity group so that it can be authorized?

[Colby LeMaire]

There is not enough detail in your question to give you a specific answer.  Can you post a screenshot of the failure details?  Is the device attempting 802.1x or MAB?  What kind of device?  Is it failing authentication?  Or is it passing authentication and just matching on an authorization rule with Deny Access as the result?

[getaway51]

Hi, 

The device is an avaya device. It passed authentication due to monitor mode now. However it failed MAB authorization due to Identity groups not in Authorization policy. It went to Cisco ISE default Identity group - profiled-Avaya device. It DenyAccess due to IG nt in Authorization policy. So now i need to add the MAC into relevant IG.

[Colby LeMaire]

No, you just need to create a rule in your authorization policy that is for Avaya IP Phones, set the condition to look for the Avaya profile, and then assign whatever permissions you want.  I am assuming that the device is being profiled properly.

[getaway51]

Hi
There is already authorization rule for the identity grp. I just to add
those failed devices mac into the grp.
Those devices mac i gt frm live logs

[Colby LeMaire · Accepted solution]

Then go to Administration->Identity Management->Identities->Groups and find the group that you have the authorization rule for.  In there, click "Add" and then add the MAC addresses to the group.  That's it.

You can also do it through Context Visibility.  Filter for the MAC address, click on it, select "Edit" and select the group you want it to be in and check the "Static" box.