Hi;
I have this simple topology:
Conditions:
- I configured Realm and downloaded user & groups on FMC.
- I configured pxGrid between FTD and ISE and they are up and running.
- I configured a correlation policy on FTD so if any malware is detected, it sends quarantine response to ISE.
- I have a authorization rule on ISE which is above all other rules and matches with packets marked as Quarantine by FTD.
ISE authorization rule:
Correlation policy on FTD:
The remediation config is simple as below:
just for reference, the pxGrid config on FTD is just like this:
The problem is, a wired client with static IP address is successfully authenticated by native windows dot1x with domain credentials but it matches the ISE rule that I've mentioned above and get quarantined. I don't know why it matches that rule on FTD! This is the portion of the ISE RADIUS live logs which shows this match:
24323 Identity resolution detected single matching account 24343 RPC Logon request succeeded - user02@xinmix.local 24402 User authentication against Active Directory succeeded - xinmix 22037 Authentication Passed 11814 Inner EAP-MSCHAP authentication succeeded 11519 Prepared EAP-Success for inner EAP method 12314 PEAP inner method finished successfully 24715 ISE has not confirmed locally previous successful machine authentication for user in Active Directory 15036 Evaluating Authorization Policy 15048 Queried PIP - Radius.NAS-Port-Type 15048 Queried PIP - EndPoints.LogicalProfile 15048 Queried PIP - Session.EPSStatus 15016 Selected Authorization Profile - TQuarantine 11022 Added the dACL specified in the Authorization Profile
Despite that FTD should mark only malwares as quarantine and inform ISE to block only clients downloading malware through pxGrid, It seems that FTD marks "all of the packets" as quarantine, so the ISE sees those packets' status "ESPStatus include Quarantine" and then blocks them. any Idea?
Accepted Solutions
