Question

A security engineer has ISE profiling several device types: IP cameras, badge readers, and building sensors, each matching its own endpoint profiling policy. The engineer wants a single authorization rule that grants all of these IoT devices the same restricted dACL, without listing each individual profile in the authorization condition or maintaining separate rules. What is the most efficient way to accomplish this?

Accepted Answer

Create a logical profile that groups the IP camera, badge reader, and building sensor profiling policies, then reference the logical profile in a single authorization condition

Answer

Statically assign each endpoint to a custom endpoint identity group and match the identity group in the authorization policy

Answer

Enable the exception action on each profiling policy to force the endpoints into the Profiled endpoint identity group

Answer

Configure a parent profiling policy with a minimum certainty factor and set the child policies to feed into it via CoA