Pushing object groups dACLs through ISE

[orp]

Hey all,

Is it possible to push dACLs containing object groups to the switch? Do I need to configure the object groups locally on the switch or can it be pushed too?

My main goal is to minimize the amount of ACEs, in order to do so I want to group a few services into an object group and then apply the ACL on it.

Thanks in advance.

[Spooster IT Services · Accepted solution]

Hello @orp,

Good question !! I have never found any Cisco's document having any information regarding this but I have a very poor experience with these object-groups on switch and routers. While checking I have found that on ISE 2.1 and later, you can create a DACL with object-group such as "permit tcp any addrgroup myobject" and you need to create these object groups locally on switches.

I would like to recommend using them in a test environment first as they are never get tested.

***Please mark all helpful posts***

[orp]

Thanks for the answer! Seems like checking it on a test environment will be necessary indeed.

Just to make sure - In case I'll apply a dACL like this - "permit tcp any addrgroup myobject" and "myobject" contains 3 different hosts, it will count as 1 ACE for the 64 ACEs limit, right?

[Spooster IT Services]

Yes, that is true.

[Marcelo Morais]

Hi @orp ,

 please take a look: CSCvj94873 Add possibility to use object groups in DACL on ISE ...

Last Modified: Mar 10,2020
Status: Open
Severity: 6 Enhancement
Symptom: Currently ISE allows to create the DACL only in the format supported by switches (i.e. the source should be 'any', object groups are not allowed, etc.).

Hope this helps !!!

[thomas]

Please read the ISE Secure Wired Access Prescriptive Deployment Guide which does a good job of documenting switch configuration including pushing dACLs.

• Pre-Authentication and Post-Authentication Access Control with Low Impact
• Switch Configuration for Low Impact Mode
• Downloadable ACL Authorization
• Validating ACL Authorization/Low-Impact Mode