New_to_ISE: How to Configure the policy set to hit only by the username.

[Chaitanya lohith]

Hi All,

I have 10 users and 10 profiles configured. Now i wanted map profile 1 to user 1. i.e. when a user 1 is authenticated ISE has to send the authorization profile1 in access-accept. like that for all 10 users. 10 policy sets.

i tried with Radius-username in "string" and Identity Name in "string" but no luck. Can you please provide me the correct condition i need to use for above scenario?

I am Actually from FreeRadius user and migrating to ISE. In Freeradius, the contents of Access_accept lie under the username, there i am looking for how to do same in ISE?

Example freeradius Profile:

User Auth-Type := eap, Cleartext-Password:= "password"
Reply-Message = "Hello, %u",
Filter-Id = "test.in",
Tunnel-type = 13,
Tunnel-Medium-Type = 6,
Tunnel-Private-Group-ID = 12,
Cisco-AVPair += "ip:inacl#1=permit ip any 1.1.1.2 0.0.0.0",

User2 Auth-Type := eap, Cleartext-Password:= "password"
Reply-Message = "Hello, %u",
Filter-Id = "test2.in",
Tunnel-type = 13,
Tunnel-Medium-Type = 6,
Tunnel-Private-Group-ID = 12,
Cisco-AVPair += "ip:inacl#1=permit ip any 1.1.1.1 0.0.0.0",

[paul]

The RADIUS username or Network Access:Username attribute work.  I use them all the time.  Either you are failing in the authentication phase or your authorization rule is not quite right.  Click on the details in the live log to see where things are failing.

[Chaitanya lohith]

Thanks for suggesting the solution. Can you please provide me the sample config?

[paul]

Use the attributes I said. RADIUS:Username or Network Access:Username to specify the username you are looking for. Use the contains, matches, equals, etc. based on how you want to match it.

[Chaitanya lohith]

Hi 

I have tried what you said but no luck. Any correction in  the attached policy condition?

[paul]

That looks right.  Paste in your authorization rule and the details of the authentication.  The details should tell you what is going on.