Push two authorization profiles in one authorization policy

[dgaikwad]

Hello Experts,
I am running ISE 2.4 with patch 4.
In the authorization policy is it possible to push two authorization profiles?
If yes, then which ones will take the precedence?
Or is this something that the design of ISE does not allow?

Any pointers or documentation to achieve this?

[Mohammed al Baqari]

No you can't combine two profiles in one rule. With the profile you can
combination of ands and ors nested

[Damien Miller]

I think you might get more helpful advise if you were to try and explain why you think you need two authorization results. To clarify the terms, I'm assuming authorization results because that's what ise would send back to the switch/wlc. As indicated in the previous post, it's not possible, but there are usually ways to accomplish most rule requirements.

[dgaikwad]

I was thinking about a use case, where the WLC has ACL has a limitation of 64 lines in single ACL. So, what if I create multiple dACL and push them via authorization profiles, thus increasing the overall capacity.

[bern81 · Accepted solution]

Hi,
I know this is not directly related to your question but I don't think you can push DACL to WLC, you can create ACL locally on the WLC and call it by its name in the Authorization profile via "airspace ACL" option.

[hslai]

bern81 is correct that WLC not using DACL. If needing many ACEs, then you should consider another solution (e.g. ASA) to perform the enforcement.

[dgaikwad]

Well, that makes sense...

Thank you for all the inputs...

[hslai]

If the matched authz policy rule has multiple profiles. They are combined in such way that distinct attributes will all apply and the first values of the same attributes will apply.

For example, the following rule has three authz profiles:

1. dACL PermitALL -- with the attribute for DACL -- PERMIT_ALL
2. vlan 100 -- with the common task VLAN set to 100
3. vlan 101 -- with the common task VLAN set to 101

As the DACL is unique and VLAN assignments are duplicated, the resulting permissions would have DACL PERMIT_ALL and the first VLAN assignment, which set to 100.