Cisco ISE Network Devices

[Netmart]

Hello,

For some reason, a AAA Tacacs request is hitting the wrong TACACs profile, instead of Priv15, Priv Lev1 is assigned.

I checked this particular node and it appears to be present as /32 in one device group and as /20 in a second one:

Network Device List sequence:

Link: Administration > Network Resources > Network Devices List

#1 List: 10.23.140.100/32

#6 List: 10.23.128.0/20

What approach does ISE take in Network Device List:

Top to bottom and/or the one with longest prefix match.

Please advise.

Thanks.

[Greg Gibbs]

Longest prefix match

[Netmart]

Thank you Greg.

For some reason, it seems to hit the less precise prefix match: #6 List: 10.23.128.0/20.

Is there any best practice/recommendation to troubleshoot this [beyond analyzing accounting logs].

[Greg Gibbs]

AFAIK, the longest prefix match should be used so this could be a bug. It would be best to open a TAC case to confirm and investigate.