I have noted recently that ISE allows to create two overlapped NAD objects in terms of IP. Does anyone have an idea how the matching process looks like then? In our company /24 object had preference causing issues. I am wondering if this is anywhere documented.
See example below:
Solved! Go to Solution.
OK. I think concept is as follow.
Lets assume there are 4 NAD objects as follow:
TEST.IP1 = 184.108.40.206/24 (Type IP address)
TEST.IP2 = 220.127.116.11/32 (Type IP address)
TEST.IP3 = 18.104.22.168/32 (Type IP address)
TEST.IP4 = 22.214.171.124-9/32 (Type IP range)
Matching order will be:
1. TEST.IP2 and TEST.IP3 becuase the longest match
2. TEST.IP1 becuase IP address type has higher preference over IP range object
3. TEST.IP4 becuase IP range object has lower preference than IP address object
It may be miisleading becuase defining range 126.96.36.199-9/32 administrator expect that it will matched over entire subnet 188.8.131.52/24 but becuase IP range object has lower preference than IP address type its exactly oposite.
Actually our problem started when we had "IP range" object containing two IPs "184.108.40.206-9/32". It had been never matched despite the there were only one overlapped "220.127.116.11/24" IP address object. Then i asked this question why longer matches didint happen between "IP range" and "IP address". ISE documentation explains that type "IP address" has always higher preference over "IP range". Thats why my test provides results exacly as follow:
As i said it may be sometimes missleading