ISE policy

[BigK]

Trying to understand and apply policy set on ISE 2.4 on the lab environment. Your comments and advice on ISE policy that I just built are appropriated. 

1. Policy set name is self-explanatory
2. Conditions: Device must be Wired_802.1x or Wired_MAB and be connected to Karim_lab-switch.
3. Use the allowed protocols that are in Default Network Access

AUTH_C Policy

1. AUTH_C Policy name is self-explanatory
2. Conditions: Device must be Wired_802.1x or Wired_MAB and be connected to Karim_lab-switch.
3. Use internal users and if it fails continue to default.

AUTH_Z Policy

1. AUTH_Z Policy name is self-explanatory
2. Conditions: Device must be Wired_802.1x or Wired_MAB and be connected to Karim_lab-switch.
3. Result : Permit access to Karim_lab-switch.

[Mohammed al Baqari]

You are using AND operation in your configuration which wrong and should be OR. Also, you can't have two authorization profiles as result in one rule

[socratesp1980]

Based on your screenshot a device needs to be authenticated with bot dot1x AND mab. Your permit access authorization policies will conflict your karim_lab_switch authorization policy. What is you are trying to do? Device admin? or dot1x for a network device?

[bern81]

Hi,

Change the AND condition with OR, it can not be 802.1X and MAB.

Also the Authorz Profile is wrong, choose one of them.

[BigK]

@Mohammed al Baqari

@socratesp1980

@bern81

Thanks!

what I am trying to do is to have devices connected to other switches won't match my policy set.

[Mohammed al Baqari]

Thats fine. Change and to or and have single profile in authorization. It will do what you want

[BigK]

@Mohammed al Baqari 

Thanks Mo!

could you kindly show me how to achieve that with a single profile in authorization ?

Much appreciate it!