I'm looking to replace my CDA with ISE for transparent user auth for our WSA.
The thing that I'm seeing is when I want to add users and groups to an access policy, I cannot add AD Groups like I can with the CDA setup. I can only use SGT's. That's fine for wireless users who auth with dot1x because I can add the SGT based on AD group.
For wired users not using dot1x passive ID maps the user to the IP, and If I add the username to the access policy on the WSA it works, however these users don't have a SGT. Is there anyway to add a SGT to an AD group? Or anyway to make a policy on the WSA using an AD group with PassiveID and ISE?
