Hello, our 9200 switches with code 17.9.4a receives dacl from ise and authorize clients successfully. Based on the complaints (endpoint can access to destinations that they shouldn’t as destinations not allowed in DACL) we started to see if anything goes wrong with switches and saw that while client stays as authorized and acl is applied to client port (sh authen sess int), acl does not exist on switch when we run show ip access-list command.
Anybody has the same issue? We suspect on device tracking. If device is removed from tracking table maybe switch removes ACL too but not sure on that.
