cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1326
Views
0
Helpful
2
Replies
Beginner

Multiple downloadable ACLs per user group in ACS

Is it possible to map multiple downloadable ACLs to a single user or user group using ASA and ACS?

For example, you have an ACL controlling access to servers (ACL A), and another ACL controlling access to internet (ACL B). Is it possible to assign multiple ACLs to a user group, such that User Group A can only access servers, while User Group B can access both servers and internet (ACL A+ ACL B)?

Thanks and regards.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Multiple downloadable ACLs per user group in ACS

George,

The User and group settings would only allow you to select only one DACL instance at a time.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080a9eddc.shtml#configuringtheserverwitfddhias

Regards,

Jatin

Do rate helpful posts-

~Jatin Katyal

View solution in original post

2 REPLIES 2
Highlighted
Cisco Employee

Multiple downloadable ACLs per user group in ACS

George,

The User and group settings would only allow you to select only one DACL instance at a time.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080a9eddc.shtml#configuringtheserverwitfddhias

Regards,

Jatin

Do rate helpful posts-

~Jatin Katyal

View solution in original post

Highlighted
Beginner

Multiple downloadable ACLs per user group in ACS

Ok,

I created multiple authorization profiles (each with a DACL) and attach it to an access policy result. However, only the DACL in the first authorization profile is picked. So the answer is simply, it's not possible.

Thanks for your help.