Nested Endpoint Identity Groups - What for?

[Arne Bier]

Hello,

I like the idea of creating EIG (Endpoint Identity Groups) in a hierarchical fashion, but I have run into a limitation - wondering if there is a solution for this.

If you create an EIG Hierarchy as follows:

Parent 1
Parent 2

and under each Parent, create a Child 1 Endpoint Identity Group, so that the result looks like this:

Parent 1
  Child 1
Parent 2
  Child 1

then you can create RADIUS Policy Set rules that refer to each Parent:Child relationship (where the semicolon is the delimiter) as

"Parent 1:Child 1"

or

"Parent 2:Child 1"

However, in Context Visibility, you cannot tell who the parent is when an endpoint is assigned as "Child 1" of either parent - that level of granularity is not available. In Context Visibility, you can statically set an EIG, but in the drop-down list, the options appear as 

Child 1
Child 1

No context about the parent. 

In the Context Visibility Browser, you don't see the Parent details either, and even worse, in the CSV import, there is no way to be specific about the exact Parent:Child relationship- you can only specify an EIG name - who knows where the endpoint will be assigned to...

So is it a bug, or just lacking feature support in ISE ?  Why allow hierarchical nesting of groups, when the implications of using such a feature makes it very hard (or pointless) in practice?

[Marcelo Morais · Accepted solution]

Hi @Arne Bier ,

 I totally agree !!!

 For me is  "just lacking feature support in ISE" ... as a workaround, what I do is something like this:

Parent 1
  P1-Child 1
Parent 2
  P2-Child 1

Best regards

[Arne Bier]

@Marcelo Morais that's a great workaround - your naming conventions allows me to create the hierarchy in "Administration / Identity Management / Endpoint Identity Groups" screen to collapse the Groups under their parents. I like that! Thanks