ISE session limit vs Group Policy session limit who wins?

[cgarringer]

We have ISE authentication on VPN, when successful ISE returns the session timout, idle timeout and the Group Policy .    The Group Policy configured on the FMC also sets the session and idle timeouts.     We appear to be getting  mixed results, some users are getting ISE limits and some are getting the Group Policy limits.   Which is supposed to have priority?

[Milos_Jovanovic]

Hi @cgarringer,

There is a priority for standard attributes which can be defined in multiple points (e.g. IP pool can be defined under tunnel-group, but also under group-policy). You can find more details here. Depending on how you configured these attributes, they will either take presedence from AAA server or from local ASA configuration.

Kind regards,

Milos