Policy Sets and Authorization Profiles

What it is

A policy set is an ordered group of rules that tells ISE how to authenticate a request and what access to give.

ISE checks the policy sets from the top, and the first one whose condition matches is used. Inside it, an authentication policy decides who the user is, and an authorization policy decides what access they get.

How it works

Rules are read from top to bottom, and the first match wins at each level.

Policy sets

Open Policy, Policy Sets. Each row is a policy set with a name, a condition, and allowed protocols or a server sequence. A default policy set sits at the bottom to catch anything unmatched.

A good design uses one policy set per kind of access, such as wired, wireless or device administration. Keep the conditions at this level broad. The detail belongs in the rules inside.

Conditions

A condition compares an attribute with a value. ISE stores common conditions in a library, and you can build your own from dictionaries of attributes. You can combine conditions with AND and OR.

Useful library conditions match wired 802.1X, wireless 802.1X, wired MAB and wireless MAB. Other attributes come from the request, from the identity store, or from the endpoint profile.

Allowed protocols

The allowed protocols list controls which authentication methods ISE will accept. It sits under Policy, Policy Elements, Results, Authentication.

You pick it on the policy set. If a method is not on the list, ISE rejects a request that uses it. This is why a missing EAP method or missing host lookup shows up as a rejection in the live logs.

The authentication policy

Each rule in the authentication policy has a condition and an identity source. The source can be a single store or a sequence. A rule can also say what to do on failure.

The choices cover three failure cases: authentication fails, the user is not found, or the process fails. Continue is useful for MAB, so that an unknown MAC address can still get a limited result.

The authorization policy

Each rule has a condition and a result. The result is one or more authorization profiles. The first matching rule gives the access.

Rules usually use identity groups, directory groups, endpoint profiles, posture status and the type of network. ISE also has exception rules that are checked before the main rules, at local and global level.

Keep a final rule at the bottom for devices that match nothing. In ISE this is the default rule, which normally denies access.

Authorization profiles

An authorization profile is a named bundle of results. Create them under Policy, Policy Elements, Results, Authorization, Authorization Profiles.

ISE has some profiles ready made. The permit access profile gives an accept with no extras, and the deny access profile rejects.

What ISE returns

The profile is turned into RADIUS attributes. A VLAN becomes the tunnel attributes for private group ID, tunnel type and medium type. A downloadable ACL becomes a Cisco vendor specific attribute with the ACL name.

An advanced attributes section lets you add other attributes by hand. Use it for vendor specific needs. Check the exact attribute names against the device documentation before you add them.

Downloadable ACLs

A downloadable ACL is a list of permit and deny rules stored on ISE. The switch downloads it when the endpoint authenticates. You create them under Policy, Policy Elements, Results, Authorization, Downloadable ACLs.

The ACL is written with the keyword any as the source, because the switch replaces it with the endpoint address. A DACL is neat because you change one list on ISE and every switch gets it.

permit udp any any eq domain
permit tcp any host 10.2.2.10 eq 443
deny ip any any

Check the result

Switch# show authentication sessions interface GigabitEthernet1/0/5 details
Switch# show ip access-lists

On ISE, the live logs show which policy set and which rule matched, and the authorization profile that was returned.