ISE3.1 network device groups hierarchy

[EHNET]

Hi, I am new to ISE and try to implement it. But I am confused by the hierarchy of NDGs

For example, I created a parent group called Building A using All locations as root group.

And  then I created two child groups of Building A, called them floor 1 and 2, added one device to each child group.

But if I write a condition in policy set to match parent group, Building A, it wont match any devices included in its child group. Is it supposed to work like this way ? or I used it wrong ?

And as shown in the picture, the group numbers for Building A is 0. Why this number does not include all its children group devices ? 

[Greg Gibbs · Accepted solution]

That is working as designed. If you want to create a matching condition for all devices under the 'Building A' parent group, you would use 'DEVICE·Location STARTS WITH All Locations#Building A'

[EHNET]

Thanks for your prompt response, I will try that.

But as for the group member count, the parent group is not the sum of its child group ?

[Rodrigo Diaz]

hello @EHNET in which version of ISE are you seeing that behavior ? what happen if you click on the 0 that is in front of Network  device group Building A ? 

[EHNET]

I am on ADE-OS Version 3.1.0.135. Please see my screen capture in another reply

[Charlie Moreton]

@EHNET , no the group member count is for devices, not subgroups.  Since there are no devices in the group All Locations#BuildingA, the count is 0.  All Locations#BuildingA#Floor1 contains 1 and All Locations#BuildingA#Floor2 contains 1.

@greg is right, choose the Starts with condition and select All Locations#BuildingA to select all floors within that building.

[EHNET]

Right, I know group member count is for devices not subgroups.

But ISE doesn't work in this way.  When I click that parent number, it shows 0 devices in the parent group. I think it should be the sum of all its child group and the count should be 8, right ?

I am on  ADE-OS Version 3.1.0.135