ISE policy set (Machine+user)

[ibrahim_hassan]

Is there any way to create authorization rule that combine both machine and user identity groups in one rule?

for example, authorization profile match only if computer in external identity X and username in external identity group Y.

[Marvin Rhoads]

Sure, we commonly use EAP chaining to address this use case. Please see "HowTo: EAP Chaining Deployment Configurations" on the ISE Design Guide page. 

Specifically see the section beginning on page 15 which describes:

In this example, these rules will be defined based on the EAP-Chaining results:

• If both user and machine both succeeded

• If user succeeded and machine failed

• No chaining is supported