ISE posture based upon switch user is connected to

[bberry]

OK, I am a new ISE user and definitely an early beginner on creating ISE policies. I have successfully created a policy that can determine if you are using a corporate asset or not and using 802.1x authentication grant you access to corporate resources or not. This policy also assigns the VLAN the user is placed into. Seems to work quite well so far at least as a baby step in policy creation.

Our building has different VLANS based upon floors and the like and I would like the policy(s) take this into consideration when assigning the VLAN. Is there a way to include which switch the postureing process is flowing through to assist in assigning the VLAN? I am thinking I would have separate policies based upon the switch / stack but not sure how to include that in the logic. I figured it would be similar to my policy where I check corporate assets and that you are wireless and that you have a valid AD account but have been unable to figure out the endpoint part. I have created network groups for my network devices but am stumped after that. Is there something else I should or could be doing instead? Do I need a completely different train of thought?    

Brent

[nspasov]

Hello Brent, using "Network Device Groups" can definitely make this possible for you. For instance, you can create a "Location" based group hierarchy that looks like something like this:

All Locations > HQ > Floor-1

All Locations > HQ > Floor-2

All Locations > DR > Floor-1

...

etc

Then you can reference that group in your authorization policy by using something like this

If "Conditions > Device > Location" = All Locations > HQ > Floor-1

then

Permissions = "HQ_Floor-1-Posture"

...

If "Conditions > Device > Location" = All Locations > HQ > Floor-2

then

Permissions = "HQ_Floor-2-Posture"

...

I hope this helps and addresses your issue. 

Thank you for rating helpful posts!