ISE Posture with static addressing

[victormanuelsolis]

Hello Team,

I'm struggling configuring the posture for +600 users with static addressing (this addressing is assigned by ISE) I can't make the ISE applies the iP address for each user plus works the ISE Posture at the same time within my policy, anyone can help me?

CISCO ISE 2.4

[ahollifield]

So you are using the ISE local DHCP server?  How is ISE assigning static IPs to clients?  IP Device Tracking enabled on the NAD?

[victormanuelsolis]

Nope, all the addressing is static, no DHCP, I created each autorization profile with each framed iP, so this profile is the iP the user receives

[ahollifield]

Interesting.  What is the use-case here?  So you have 600 AuthZ profiles? One for each user?  

[victormanuelsolis]

Yes, its a customer requirement to have more control over the users

[Marcelo Morais · Accepted solution]

Hi @victormanuelsolis ,

 if my understanding is correct, you would like not only to use the IP Addr of the Device as a Condition to the Authorization Policy, but also check the Posture status, please try the following (as an example):

At Policy > Policy Set, you created a Wired-Policy, for ex.:

Authorization Policy 

 Rule Name: John-Doe-AuthZPolicy-Compliant

 Condition:  Network Access.Device IP Address Equals 10.10.10.1 AND Session.PostureStatus Equals Compliant

 Result: <AuthZ Profiles Result for Posture Compliant>

 Rule Name: John-Doe-AuthZPolicy-Unknown

 Condition:  Network Access.Device IP Address Equals 10.10.10.1 AND Session.PostureStatus Equals Unknown

 Result: <AuthZ Profiles Result for Posture Unknown>

Hope this helps !!!

[victormanuelsolis]

Thank you Marcelo,

I tried a solution pretty similar last week and it seems is working The difference is I configured only 1 policy for compliant and noncompliant at the end of policy set and the unknown condition for each user, a lot of work to add manually this condition but its ok. Thank you again.

Regards,