ISE 2.3 BYOD moving non-compliant users to a different SSID

[Madura Malwatte]

ISE 2.3 patch 5

I am doing byod with dual SSID, once the user onboards they switch over from the byod ssid to the secure corporate SSID. Then they go through posture check, if a user is deemed non-compliant is there a way we can force them out of the secure corporate SSID and on to maybe the guest SSID? We don't want to leave a posture non-compliant user in the corporate SSID. What options are available besides restricting access using an ACL?

[Mike.Cifelli]

You can accomplish this by using separate authorization policies and using the predefined PostureStatus ISE conditions:
For example:
Session PostureStatus equals Compliant THEN have authz result move host into secure area.
Session PostureStatus equals NonCompliant THEN have authz result move host into non-secure area

HTH!

[Madura Malwatte]

Hi Mike,

Yes I am aware of the posture status conditions and currently using them. I am not sure how to "have authz result move host into non-secure area", how can this be done for wireless?