Identity rules priority

[boris.majstorovic]

Our customer want to implement 802.1x autentication with ACS 5.2 and AD as external identiti base.

But when non802.1xcapable device conect to 802.1x enabled switch port autentification should be with MAC.

We have configured switch with 802.1x and MAC auth bypass.

Also define AD as external identiti base, and MAC addreses in internal hosts.

There are two policies in

Access Policies > ... > Access Services > Default Network Access > Identity

2.AD                                        NDG:Location in All Locations     AD1

1. Non802.1xCapableDevices      NDG:Location in All Locations     Internal Hosts

The problem is taht only frst rule is considered. If we try to autenticate with LapTop with 802.1x disabled (MAC is in internal host) autentication - OK. When we enable 802.1x on LAN there is no autentication (user not found).

After we changed order of policies:

1.AD                                        NDG:Location in All Locations     AD1

2. Non802.1xCapableDevices      NDG:Location in All Locations     Internal Hosts

The situation is reversed, user is autenticated but MAC isn't.

Where is the error?

Thanks

[Yudong Wu · Accepted solution]

In Access Policies > > Access Services > Default Network Access > Identity, if you use "   Rule based result selection"

ACS should just usethe first match.

You can configure a "Idnetity Store Sequence" in Users and Identity Stores > Identity Store Sequences, make sure you select the "internal host" first and then AD. Then you can use this "identity store sequence" in "Default Network Access > Identity".

[boris.majstorovic]

Thanks

It solved the problem