ISE Management Policies Sugestion

[julianomluz]

I want to simplify our management policies in ISE  for the devices. For management policies I mean the rules that allow access (cli, http, console) to the devices. We have dozen of different device types (routers, switches, firewalls, ...) and today we filter this by NAS-Service-Type and NAS-Port-type. Since every brand/model send different attributes, the rules are becoming confuse. My question is how do you organize this type of rules? Is there a way to filter management access using only a few common conditions? 

[Charlie Moreton]

Device Admin in ISE allows for Policy Sets.  I build out my TACACS Profiles based upon Vendor and Type.  Then I create a different Policy Set per Vendor and Type (switches/Wireless Controllers/etc.)  Of course, those that use the same attributes can be (and are) grouped in the same Policy Sets.

[thomas]

Since Charlie did not shamelessly plug his upcoming webinar on this very topic, I will!

Register for Building ISE RADIUS Policy Sets happening next week!

If you cannot make it, it will be posted to our CiscoISE YouTube Channel ~1 week after the delivery.