Duplicate entries in dACL causes dot1x authorization to fail

[SMD28316]

I have been troubleshooting a Dot1X issue on a 9200L switch, software 17.03.03, with this dACL from ISE:

remark temp
permit ip any host 10.79.114.65 <- First rule
remark DHCP
permit udp any eq bootpc any eq bootps
remark Domain
remark SCCM
permit ip any host 10.79.114.65 <- Duplicated rule
remark Drop all the rest
deny ip any any

The endpoints didn't get authorized until I removed the duplicate role, but, on older switches (for example, WS-C2960S-24PS-L 15.0(2)SE8) this problem is not occurred, duplicated rule is simply ignored. Why? Is it a bug?

[marce1000]

 - What's your ISE version , make sure the 9200L is fully supported :

            https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-device-support-tables-list.html

 M.

[hslai · Accepted solution]

This is expected.

Security Configuration Guide, Cisco IOS XE Gibraltar 16.11.x (Catalyst 9300 Switches) > Restrictions for IEEE 802.1x Port-Based Authentication says,

...

If a downloadable ACL contains any type of duplicate entries, the entries are not auto merged. As a result, the 802.1X session authorization fails. Ensure that the downloadable ACL is optimized without any duplicate entries, for example port-based and name-based entries for the same port.

...