NAS_IP Starts With in Policy Sets

[brbesset]

In 2.3, you could create a Policy Set that had a "Starts with" condition for matching a NAS_IP. However, in 2.4, we are only seeing equals/not-equals as a condition. Is this a bug or did something change in 2.4 that removed the "starts with" condition?

Thanks.

[paul]

Not sure if that is a bug or by design, but the Network Access·NetworkDeviceName.  That should be the name of the network device making the request.  Assuming you are trying to make a policy set for a particular location and that location has a good network device naming structure you should be able to use Starts with to get the desired effect.

[brbesset]

I don't think we can use the Device Name as people can bring in their devices ad-hoc. That's why it would be based of "starts with."

I disagree that this is solved. Can someone let me know if it's a bug since it was overlooked from the 2.3 version? 

[paul]

I am confused.  You were asking about NAS IP, which is the IP address of the network device authenticating against ISE.  No one is bring in ad-hoc network devices and somehow making them authenticate against ISE.  The NAS IP address structure and network device name structure should be a well understood and documented.  Assuming a good network device naming structure is in place doing network device name starts with should be similar to NAS IP starts with.

[brbesset]

Paul, We do bring in ad-hoc equipment all the time. At least we move equipment from site to site depending on needs and don't change the hostnames. It's not the "best practice", but due to the nature of business, it happens. That's why we cannot use the name as a site location. That is why we were requesting the "Starts with" for IP. I still think it's a valid request.

[hslai · Accepted solution]

Assuming this referring to Radius.NAS-IP-Address, I checked both ISE 2.2 and 2.3 in our lab and found its operator can only be Equals/No Equals, exactly the same as ISE 2.4.

ISE 2.2 introduces network conditions, which can be used to achieve this objective.