ISE 2.2 cannot apply TACACS Authorization Policy to a prent group

[B. BELHADJ]

Hi guys

Could you please let me know why ISE 2.2 (at least for me) cannot apply the Authorization policy for a parent group?

For example when I create a Groups like:

ALL_Perimeters/SEC

ALL_Perimeters/LAN

ALL_Perimeters/WAN

SECGroup ==> RW ==>  ALL_Perimeters/SEC

LANGroup ==> RW ==>  ALL_Perimeters/LAN

WANGroup ==> RW ==> ALL_Perimeters/WAN

ALL ==> RO ==> ALL_Perimeters

The Authorization Policies have been configured like that:

"Rule name: SecTeam" ==> If "SECGroup" and "DEVICE:Perimeters EQUALS All_Perimeters#SEC" then "Command Sets: RWCommands" AND "Shell Profiles: Privilege15"

"Rule name: LANTeam" ==> If "LANGroup" and "DEVICE:Perimeters EQUALS All_Perimeters#LAN" then "Command Sets: RWCommands" AND "Shell Profiles: Privilege15"

"Rule name: ALLTeams" ==> If "All Groups" and "DEVICE:Perimeters EQUALS All_Perimeters" then "Command Sets: ROCommands" AND "Shell Profiles: Privilege15"

Tacacs_Default If no matches then Deny All Shell Profile

When a user in the group SECGroup tries to access to a device in the perimeter LAN, it cannot access. In the logs the default Authorization Policy with Deny is matched.

But when I configure an Authorization Policy with RO for SECGroup on the All_Perimeters#LAN for example, the user is able to connect!

The Authorization Policies are very well configured. I don't have this issue with ACS 5.8 in my production environment.

Any reply will be appreciated.

Best regards.

[Arne Bier · Accepted solution]

Not sure whether I fully grasp the issue at hand, but have you tried using STARTSWITH instead of EQUALS?  I have run into this before when I want to match a prefix and I use EQUALS, when instead, ISE requires the operator STARTSWITH to match a prefix.

[B. BELHADJ]

Hi Arne

Thank you for your help!

This was the issue. I have just used STARTS WITH instead of EQUALS and the user was able to connect.

Best regards