cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

799
Views
0
Helpful
1
Replies
Highlighted
Enthusiast

ISE Authorization Compound Condition

I am trying to add a compound condition that points to an internal identity group in an authoirization profile. Something like the rule below.However the rule never gets applied for users in the IT identity group. It moves to the next rule down and applies permissions based off another rule specific for just the device type. If I change the rule conditions to use the identity group instead of the device type it works. However, I want to limit the rule to device type and Identity group. Any ideas would be appreciated.

Rule Name: test       Conditions: Android and IT (Expression: InternalUser:IdentityGroup EQUALS IT) then PermitAccess                  

Everyone's tags (4)
1 REPLY 1
Cisco Employee

ISE Authorization Compound Condition

try creating device groups and match them

Network Device Groups List > New Network Device Type

Network Device Groups

* Name               

Description       

* Type  

Authentication RulesEnabled

Name

Condition

Protocols

Identity Source

Options

TestAuthentications

IF

Device:Device Type = Device   Type#All Device Types#Test

allowprotocols

DefaultNetworkAccess

and use

demo.local

RejectRejectDrop

MAB

IF

Wired_MAB

allowprotocols

DefaultNetworkAccess

and use

InternalEndpoints

RejectRejectDrop

Dot1X

IF

Wired_802_1X

allowprotocols

DefaultNetworkAccess

and use

AD_InternalUsers

RejectRejectDrop

Default Rule(if no match)

allowprotocols

DefaultNetworkAccess

and use

Internal Users

RejectRejectDrop