Cisco ISE Policy getting wrongly selected

[md-shahnawaz]

Hello All.

i am using LAN to connect in my office, I am seeing my secure vpn client network is on wired, ISE posture status is also showing complaint (network access allowed) but on ISE I am seeing I am hitting to Wi-Fi policy instead of wired policy and ISE logs also show i am complaint.

I am not able to understand why i am not hitting to wireless ISE policy if I am on wired, I checked logs for my team and their profile is correctly updated. please suggest what i need to check to fix this issue.

[Rob Ingram]

@md-shahnawaz it is probably the conditions you are using in your authorisation policy need tweaking, to ensure the correct connection method matches the correct rule.

Please provide screenshot of your authorisation rules, and indicate what rules the connection is matching and should match.

[md-shahnawaz]

hello Rob

thank you for your inputs, now after restarting i am seeing posture status is showing no policy server detected and default network access is in effect, on ISE logs could see I am hitting to Wi-Fi policy whereas I am on LAN.

[Rob Ingram]

@md-shahnawaz the connection is probably still not matching the correct authorisation rule, so does not get the posture redirect, thus not detecting the policy server. You need to ensure the connection request matches the correct rule.

Provide a screenshot of your authorisation rules and the output of the live log of your connection event and we can help.

[Dustin Anderson]

I would also maybe look at your policy sets and break them out by type to make rules easier to read and follow.

Thus is how ours is set.

[md-shahnawaz]

Hello Dustin, issue which i am suspecting is secure client is not able to detect the PSN nodes and getting stuck in posture redirect policy and its not moving further. i am not sure where and what to check?

[Dustin Anderson]

It would depend how your rules are set and if it's too vague if that makes sense. You usually want them in order so compliant user would be before the redirect. Redirect would usually be for non-compliant or unknown status. 

Also, do you check status every connection, or does it remember compliant status for a while? When we use to do it we had it remember for a week.

For check in, make sure the device can talk to the PSN on port 8905.

[Mohammadreza Hadi]

dear @md-shahnawaz 

# Open Operations > RADIUS > Live Logs,
select the affected authentication,
and check the detailed authentication report & attributes >>
>> NAS-Port-Type ??
>> NAS-Port-ID ??
>> NetworkDeviceName ??
>> Service-Type ??
>> Called-Station-ID ??
>> SSID attributes, if present.. ??
>> The exact Policy Set condition that matched ??

Make sure the Wi-Fi Policy Set is not using overly broad conditions and is not placed above the wired Policy Set in a way that also matches wired requests.

Verify that the wired switch is assigned to the correct Network Device Group in ISE.

Check the switch AAA/RADIUS and interface configuration to confirm that it sends the correct NAS-Port-Type.

If policy selection depends on endpoint profiling, verify that the endpoint does not have a stale or incorrectly assigned profile. Delete/reprofile the endpoint only if necessary.

Compare the full RADIUS attributes of this endpoint with another wired endpoint that selects the correct policy..