ISE 2.7 does not accept msRADIUSFramedIPAddress for fixed IP addresses

[swscco001]

Hello everybody,

our customer needs a fixed IP addresses for a small number of AnyConnect users.

They have a ASA 5555 (9.14(3)15), a ISE 2.7 and the users are on the
Active Directory.

I found the following guide:
https://integratingit.wordpress.com/2017/01/01/cisco-asa-anyconnect-vpn-with-static-client-ip-address/

I confirured a test user on the AD and assigned a free IP address to it
as in the guide.

On the ISE 2.7 I could import attribute msRADIUSFramedIPAddress from the AD
(see attached screen dump).

When I want to create the new Authorization Profile the
ISE just accept an IP address but not AD-name:msRADIUSFramedIPAddress
(see attached screen dump).

It seems that ISE 2.7 just accept users located on the ISE itself for
this sitiation.

I did not find another guide for this situation.

My questions:

Why does the ISE 2.7 I does not accespt the attribute msRADIUSFramedIPAddress
as in the guide but want an IP address?

Is it supported to authenticate with an AD user with ISE 2.7 and assign
a fixed IP address? If yes, is there another guide?

Thanks a lot for every hint!

Bye
R.

[Tariq Mahmoud]

Hello, 

I don't have access to any ISE node to test the below, but can you try:
1. I see in the guide that the type of the attribute is IPv4 while in your screenshots it's showing IP. Can you modify it to IPv4 in your configuration and test? 
2. If the above doesn't work, can you try renaming your AD to any other name without the dot, "EIS_AD_SPITAL_MIS" for example.

if those won't work, I really suggest creating a ticket with TAC. 

[Greg Gibbs · Accepted solution]

This appears to simply be a cosmetic issue (likely due to the type value option changing from 'IPV4' to 'IP' at some point). I tested ISE 2.7 with both patch 7 and patch 9 and the AuthZ Profile still lets me save the change even with the error highlighted. ISE should still return this value regardless of the error. If you find that not to be the case, please open a TAC case to investigate further.

I also do not see this cosmetic issue in ISE 3.1