Cisco ISE - Creating complex policy set rules

[Marc0]

Hi All

I have ISE 2.7 and trying to create policy set rules in line with 802.1x rollout which is fairly straight forward.

However, im trying to find out if ISE will allow the creation of a single authorization policy rule with multiple conditions rules but mapping them to multiple results profiles?

Does anyone know if this is possible and If so, are there instructions on on doing this?

Thanks in advance

[Marcelo Morais]

Hi @Marc0 ,

 something like this:

Hope this helps !!!

[Marc0 · Accepted solution]

Hi Marcelo

Yes thats it, so can create but curious to understand how the condition rules link to the correct result profile when have multiple selected. Ive uploaded an example that we are trying to build 

[Greg Gibbs]

See a related discussion here - Authorization permissions in one or multiple authorization profiles 

When you 'stack' AuthZ Profiles, they are all applied to the session so you want to ensure there are no overlapping attributes (dACL, dVLAN, etc) as there is no way to specify the order in which they are applied.

For your example, both AuthZ Profiles would be applied to any session that matches any of your OR conditions.

I've personally never stacked AuthZ Profiles on any customer deployments as I feel they add more complexity rather than reducing it.

[Marc0]

Thanks Greg for the response. 

So if the view is not to stack the AuthZ profiles, is there a limitation on the number of AuthZ profiles that can be held in one policy set rule?

[Greg Gibbs]

As per the Scalability Guide... "It is not recommended to have more than 600 authorization rules in a single policy set"

If you have a 1:1 ratio of AuthZ Profiles to AuthZ Policy rules, the recommended max AuthZ Profiles per Policy Set would also be 600.