So we currently run CC 2.3.5.6 with a fully integrated ISE 3.0 and we use policy set for Wired+Wireless Authentication and have 3 VNs in SDA with multiple hierarchical L2 VN/AnyCast Gateways and associated IP Pools in CC.
Simply put: depending on MAC Address, authentication etc, we put various end-user devices in different 'Vlans' so to speak in SDA.
We do this by means of Authorization Profiles in ISE. These are then referenced in the policy set.
Because we have a fully integrated solution with pxGrid of CC + ISE, ISE obviously learns the VN, L2VNs, IP Pools, SGTs etc from CC.
The Authorization Profile in ISE has a reference under 'Common Tasks' called 'Security Group', also having mandatory fields for Virtual Network, Type as well as Subnet/IP Address Pool Name. These are all learned via pxGrid. So if I add any in CC I can see them here and pick them.
So far so good. But we just learned from Cisco that starting in ISE 3.2+ , This will no longer be possible. Instead of selecting VN, Anycast gw + Pool, the only option to do what we do now is by a) assigning an SGT to a L2 VN in CC and b) assigning an SG directly in the policy set under authorization. (there is a column for that now under policy-set-> Authorization Policy).
The only problem is that in the past, Cisco has suggested grouping multiple L2 VNs/Any cast GWs in CC into a single SGT to make downstream use of SGTs easier. That means there is no 1-1 connection between a single SGT and a single L2VN/IP Pool any more.
How can ISE/CC differentiate that with the change in config OR do I need to build new SGTs to no longer have any 1-n SGT/L2VN Ratio?
And can anyone point me to any documentation that explains this change of ISE 3.2+ ?
Thanks..much appreciated
