Best Practise of Redirect ACL for Posturing

[Madhuri Dewangan]

Hi Team,

Looking for the best practise for the number of ACEs that should be present in the Redirect ACL for Posturing.

Thanks and Regards,

Madhuri

[Mike.Cifelli]

In my experience your best bet is to limit the ACEs to only allow connectivity to your ISE node that will perform the posture checks, DNS for resolution, and then deny bootps, and https. Remember that your redirect acl is flipped. For example:
deny ip any host <ISE IP Addr> actually permits connectivity to your ISE node.

I also think that this may vary depending upon your customer requirements. HTH!

[Madhuri Dewangan]

Hi Mike,

Currently there are 70+ ACEs in the Redirect Acl. Which is currently being used in all location throughout the deployment, which i would be suggesting to make location specific, hence need the input on number of ace we should keep in redirect acl

[ldanny · Accepted solution]

It really depends on your requirements , for example you may want to provide a dACL to provide some limited access regardless of your redirect acl

In general your redirect acl should provide

• DNS
• DHCP
• ISE PSNs to which CPP portal FQDN points out
• Traffic to remediation servers if needed