ISE: differentiate Guest's accesses depending on the device

[gabrieleferrari]

Hi All,

I'm running an ISE 1.1.1 and i need to authenticate guest users.

The goal is apply different Authorization profile to the same guest user based on the thevice he use to connect to the guest wlan.

I.E.:

if guest user "user1" connect to the guest WLAN using a windows laptop, than apply "Guest" authorization profile

if guest user "user1" connect to the guest WLAN using an Apple iPad, than apply "Mobile" authorization profile

I've tried to deployed the following 2 authorization policy:

1)if "Apple-Device" and "IdentityGroup:Name EQUALS Guest" then "Mobile"

2)if "Guest" then "Guest"

but the first rule never match and even if I use and iPad to access the guest network the "Guest" authorization Profile is matched

I've verified that the iPad is correctly recognized as an Apple-Device changing for test purposes the rule table in

1)if "Apple-Device" then "Mobile"

2)if "Guest" then "Guest"

and the "Mobile" profile is correctly applied.

Any suggestion on how define a condition to match a Device and an Identity Group?

Thank You

Regards

Gabriele

[Tarik Admani]

Hi,

Can you take a look at the endpoint entry in ISE for the device you are connecting with. See if it matches the apple-ipad policy, that could be your reason. As a workaround please disable the apple-ipad profiling policy so it stick in the apple-device group. Delete the endpoint and try your test again.

Also if you can post a screeshot of the authentications page i would like to see the entry when the guest authenticates.

Thanks,

Tarik Admani
*Please rate helpful posts*

[gabrieleferrari]

Hi,

thank You for the answer.

Checking the Endpoint Identity I can confirm that it is correctly profiled

I've disabled the "apple device" condition in the authorization policy but the rule still don't match.

Rule

Authorization result

Authorization result detail

I've deleted the device from the profiled endpoint and I've repeated the test but the result is the same

Do You have any other suggestion?

Thanks for your help

Regards

Gabriele

[Giuliano Gerardi]

very similar problem here... did you manage to solve?

this looks like a bug... critical...

[gabrieleferrari]

If You want to matching internal user group under other conditions, use InternalUser:IdentityGroup instead.

For example,

InternalUser:IdentityGroup EQUALS User Identity Groups:Guest

Regards

Gabriele

[Giuliano Gerardi]

i did it by matching the word "Guest" without success

I'll try as you recommended

grazie mille

G

edit:

this way works        

thank you!!