Question

An ISE administrator has built an authorization policy set for wired 802.1X. The policy set contains these rules in order: (1) 'Employee_Full' matches AD group 'Domain Users' and permits full access, (2) 'Contractor_Limited' matches AD group 'Contractors' and applies a restricted dACL. A user who is a member of both 'Domain Users' and 'Contractors' in Active Directory authenticates successfully. The administrator expects this user to receive the restricted contractor access but instead sees full access being granted. What is the cause of this behavior, and how should it be corrected?

Accepted Answer

Authorization rules are evaluated top-down and the first match wins; move the 'Contractor_Limited' rule above 'Employee_Full' so the more specific match is evaluated first.

Answer

ISE merges all matching authorization results, so the administrator must remove the full-access permission from the 'Employee_Full' profile.

Answer

The default authorization rule is overriding both rules; disable the default rule to allow the specific rules to apply.

Answer

AD group membership cannot be used in authorization conditions; the administrator must convert the rules to use identity groups instead.