WSA read only access with ISE

[harishbau084]

how to enable WSA read only access with ISE, which VSA can be used for it ?

[Rob Ingram · Accepted solution]

@harishbau084 

Create different AuthZ rules in ISE, send a different/unique class attribute value per group (RO or admin), then on the WSA map the value sent from ISE to a WSA group, in your scenario "Read-Only Operators".

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_011000.html#con_1378352

[balaji.bandi · Accepted solution]

it works for me with ACS, should be good with ISE too try and let us know.

https://www.cisco.com/c/en/us/support/docs/security/secure-access-control-server-windows/99361-acs-shell-auth.html

http://tregubov-s.blogspot.com/2015/12/cisco-ironport-external-authentication.html