Wrong authorization profile due to bad identification

[CorpNetwork]

Hello,

Curios to know if anyone else had this issue. Computers are configured to authenticate using machine cert. Identity configured in

"Certificate Authentication Profile" set to SAN. I have ISE joined to two domains and I'm using Identity source sequence. For some reason, some computers from domain1 get authorization profile for domain2. Looking at the logs I see that ISE has different info for SAN & AD-Host-Resolved-Identities.

[Cristian Matei]

Hi,

    Authentication and authorization are separate policies from ISE perspective; as I understand, your challenge to fix is that computers from AD1 match authorization profile of AD2; to fix it, you just need smarter condition within your authorization, based on AD groups & domain or SAN values.

Best,

Cristian.

[CorpNetwork]

@Cristian Matei Look at picture ISE2.png attached to the initial post and tell me what you understand from it. Why is the "resolving identity W11-5006650 from AD1 when the actual machine is called WH5011879 (member of the other domain).

Multumesc

[wsteele@conres.com]

Keep in mind it is going to work top down.  If ISE finds a reference in the 1st domain it will try to authenticate it.  Does any type of trust exist between the 2 domains.  ISE deployments can support multiple certificate chains and profiles but each node can only support a single cert for EAP.  Are the devices from both domains using the same Network Access Devices?

[CorpNetwork]

Thank you for your reply. There is no trust between domains (had but got removed). ISE is joined to both domains. Clients are using the same NAD. I don't experience this with all clients. Based on the attached logs (pictures) you can see ISE is "confused" on what device is connected to that port

[Aref Alsouqi]

Please share your sanitized authentication and authorization policies for review. The issue could be caused by some loose conditions on the policies and also it would depend on the attributes parsed from the endpoints certificates.

[CorpNetwork]

Hi Aref. 

See attached files

[Aref Alsouqi]

Thanks. I would try to do these two things, first, I would remove the internal endpoints from "AD1_Internal_copy" identity sequence, second, I would add the identity sequence to the certificate profile. If you are using this identity sequence in other authentication rules and you don't want to change it because of that, then you can clone it and apply the changes only on the interested authentication rule.