Client Provisioning policy not hitting when AD user group is mentioned in the condition

[SHABEEB KUNHIPOCKER]

Hi,

I am experiencing a weird problem with Aruba Wireless and Cisco ISE integration that if I write my client provisioning policy as Domain users AND Domain computers AND SSID Name  then redirect to the client provisioning portal the client does not the policy. On the other hand if I write the policy as Domain computers AND SSID Name (by removing Domain users group from the condition) the policy is hit. Basically ISE is not using the user group information to evaluate the client provisioning policy when connected via Aruba Wireless. Kindly help.

NB : If I connect via wired connection (through Cisco switches) everything works as expected.

Thanks

[paul]

Are you using AnyConnect NAM with EAP Chaining? That is the only way to get User AND Computer information into ISE.