Hi I'm looking at implementing a TrustSec SGT policy using ibns 2.0 on some 3650 switches. The policy is intended to apply a "pre-authentication" SGT to clients until they have been authenticated successfully by ISE and has been assigned an SGT by ISE. I setup the following on switches running 03.07.05E.   1 When a session starts, the ibns 2.0 control policy applies a "pre-authentication" SGT tag to the clients traffic. This was done with a locally configured service-template on the switch. Once the client had successfully authenticated, the service-template was deactivated and the client was assigned an SGT from ISE (2.3 patch 5)   policy-map type control subscriber TEST_POLICY event session-started match-all 10 class always do-until-failure 5 activate service-template PRE-AUTH 10 authenticate using mab priority 10 ... event authentication-success match-all 10 class always do-until-failure 10 deactivate service-template PRE-AUTH 20 authorize   2 As the above worked well, I looked at moving the pre-authentication service-template onto ISE as a downloadable service-template. The ISE authorization profile ISE-PRE-AUTH was configured as a service-template with Access-Reject along with the attributes required to assign an SGT. This also worked as expected   policy-map type control subscriber TEST_POLICY event session-started match-all 10 class always do-until-failure 5 activate service-template ISE-PRE-AUTH aaa-server ISE 10 authenticate using mab priority 10 ... event authentication-success match-all 10 class always do-until-failure 10 deactivate service-template ISE-PRE-AUTH 20 authorize   3 The problem started when I tried to migrate this setup onto 16.x - I've tried this with 16.3.7 and 16.6.4a On 16.x, applying the "pre-authentication" SGT with locally configured service-templates works as expected. The problem occurs when I move to downloadable service-templates: The downloadable service template works as expected by applying the pre-authentication SGT However, once the client has been authenticated successfully the switch shows the client as unauthorized with no SGT tag - the client is not tagged with either the pre-authentication SGT nor the SGT assigned by ISE on successful authentication. A debug shows the message %SESSION_MGR-5-FAIL: Switch 1 R0/0: smd: Authorization failed or unapplied for client Has anyone come across this issue with ISE downloadable service-templates on 16.x? Thanks Andy ... View more