ISE - Multiple dACL

[mjrduarte]

Hi,

I have a scenario where ISE controls VPN access from a ASA.
Each user belongs to a certain AD group, and I want to configure different Authorization Profiles based on membership.
Those profiles push dACL to the client.

My question is if it's possible for a client to receive more than one dACL.
I have several ACLs that are common to everyone (like DNS resolution, or AD authentication).
I tried to add more than one Profiles on the Authorization Profile in the Policy Set, but it seems that only one gets pushed.

Thanks in advance for any help.

[Rob Ingram · Accepted solution]

@mjrduarte only one DACL would be applied to a session. You'd have to create additional DACLs that combine all the rules that you want to apply.

[Karsten Iwen]

I never tested it but I am pretty sure that this is the expected behaviour. You need to build "complete" ACLs for each context.

[mjrduarte]

That's... A lot of work...
Thank you for your help.