ISE domain PC question

[Eric Lindsey]

I am trying to figure out how to grant access to users based on user authentication and computer accounts. I am trying to setup our ISE so that if a user on our domain connects to the wifi it will check to see if the PC they connected from is a member of our domain. If the computer is a member of the domain they will get full access to our network. If they are not s member of our domain they will get put into a different vlan than only has Internet access. Ultimately I would like to have a group in active directory for computer accounts that are allowed on the wifi. Is a setup like this possible? I have tried a few things and i can not get the computer account part to work.

Sent from Cisco Technical Support iPhone App

[Philip Vilhelmsson]

Hi Eric,

Look in this thread:

https://supportforums.cisco.com/thread/2166573

I think they are talking about the same thing.

Regards,

Philip

[vikasyad · Accepted solution]

Hi Eric,

We  can create different rules in the authorization policies as per the  your scenarios. For you query we can setup the following rule

step1

: Prior to user enetering theri credentials.....machine will get authorized access when machine  boots up

iselabin.local:ExternalGroups==Domain  Computers

step2

:User will enter credentials and he will get  authorized access because of  2nd Rule.

Network Access:WasMachineAuthenticated ==True

                              AND

iselabin.local:ExternalGroups==Domain Users

Also you need to go through the MAR as you are using Macine+User  authentication.Below is the link for the same in which you can find MAR  section.:

http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UsrDb.html#wp354105.