you need to understand here how the ACL pushed to end device or port based on the identity :
https://ipdemystify.com/2020/08/21/how-the-downloadable-acl-is-pushed-by-cisco-ise-to-the-switch/
The question to be asked here :
- is this ever worked or new setup ?
1. is this only 1 port or any user Logged in from Switch not able to work?
2. other switches working as expected ?
3. what is the model of the switch and version, what is the ISE version here?
here is my notes from my docs :
dACL's, you must have IP Device Tracking enabled. If the switch is unable to determine the endpoint's IP address, the dACL cannot be applied. Do a "show auth sess int gx/y detail" to see if the authentication/authorization is successful and whether or not the ACL is applied. In that output, make sure the IPv4 field has a correct IP address. Then make sure the status shows authorized. Towards the bottom of that output, you will see what policies were applied from the server. It should show the ACL there with some random naming to keep it unique to the session. You can then do a show ip access-list <name> using that ACL name that shows up in that output. That would be the ACL that is applied to that particular endpoint's session.
If you don't see the session authorized in the show auth sess int gx/y detail output, then something is not working right. Could be authentication failed or the policy from the server could not be applied. For example, if you are trying to do VLAN assignment but the VLAN does not exist on the switch, authorization fails even though authentication was successful. If you are pushing a dACL that has incorrect syntax, that will fail as well. Finally, if there is no IPv4 address shown in that output, then the switch cannot apply the dACL.
make sense?
