ISE to assign group policies on ASA

[Stephen Brady]

Does anyone know if this is possible to use ISE to hand out group policies on the ASA based on AD group, or username?

[Saurav Lodh]

Refer to BYOD Policy Enforcement using Security Group access from below

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_Policy.html

[Jatin Katyal · Accepted solution]

Hi Stephen,

If I am not wrong you would like to push the group-policy name to configure group-lock feature. Yes, this can be done based on the AD (as a condition). Please look at the attached screen shot of how you can define the ASA group on ISE. The same group (case sensitive) should be predefined on the ASA to lock the user of the AD group to that specific group-policy only.

Once you're done with the authorization profile, create a authz rule under policy elements > authorization > create a condition with the AD group you want and select the autorization profile you created as a result in the previous step.

Regards,

Jatin Katyal

*Do rate helpful posts*