Cisco Secure ACS to Cisco ISE Migration Tool – Cannot export ACS policies

[B. BELHADJ]

Hi Guys

I’m trying to export ACS policies from ACS 5.8.1.4 to be imported later on ISE 2.2 using the ACS-MigrationApplication-2.2.0 tool.

I’m able to export all objects except the Access Plicies. In the Migration tool logs I see that the Service Selection Policy is not supported.

Below the different logs:

===================================================================================

ACS 5.8

ACSLab

=======================================================================

ASEAPTLSPhone

=======================================================================

Rule: SSPPhoneEAPTLS

Description: Enabled SSP rule 'SSPPhoneEAPTLS' points on a service that is not a network

access service. This is not supported by ISE

=======================================================================

ASMD5Phone

=======================================================================

Rule: SSPPhoneMD5

Description: Enabled SSP rule 'SSPPhoneMD5' points on a service that is not a network

access service. This is not supported by ISE

----------------------------------------------------------------------

=======================================================================

DefaultNetworkAccess

=======================================================================

Rule: Radius

Description: Enabled SSP rule 'Radius' points on a service that is not a network access

service. This is not supported by ISE

-----------------------------------------------------------------------

=======================================================================

DefaultDeviceAdmin

=======================================================================

Rule: Tacacs

Description: Enabled SSP rule 'Tacacs' points on a service that is not a network access

service. This is not supported by ISE

-----------------------------------------------------------------------

=======================================================================

Summary:

*Service Selection Policy     : Unsupported

*Authentication Policy         : Supported

*Authorization Policy         : Supported

Not all policies are compatible with ISE 2.2. Out of security concerns,

the migration application will not migrate any of your ACS 5.5/5.6/5.7/5.8

policies.

=======================================================================

                               End of Report

=======================================================================

I have attached the different Access Services in the Lab.

I have suspected the: ANY and the compound conditions with AND and OR but they are not the issue.

Any suggestion will be appreciated! Don't hesitate if you need any further information

Best regards

[kthiruve]

Hi Abdollah,

In general, the information below points to use of different service type.

Go to Access policy --> Access services and make sure the corresponding services( used in Service selection policy) has either Device administration or Network access for service type. You did mention that you attached different access services.

Need export/import/policy gap analysis logs and migration tool logs to answer further. If this is impacting, please call TAC.

Thanks

Krishnan

[B. BELHADJ]

Hi Krishnan

Thank you for your reply and your ACS to ISE migration videos!

Yes I confirm that all Access Services have Network Access or Device Administration for Service Type.

The Policy Gap Analysis report is mentioned earlier in my post. This is what I have in the Policy Gap Analysis report when trying to export just the Access Policies.

I suspect that my SSP and Access Services use some unsupported ACS attributes like NDG:  and compound conditions with a combination of AND and OR operator.

I will change the configuration on my ACS lab and update you

Best regards

[kthiruve · Accepted solution]

Hi Abdollah,

What does the export report say?

Also in the folder where you unzip the migration tool, a migration log captures all the processes/tasks in the migration tool. Please check those logs for further information.

If this is a critical problem, please open up a TAC case to debug further.

Thanks

Krishnan