Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ISE authorization policy question

I'm in the process of finishing up my authorization policy and was hoping to get some input on how to deal with freshly imaged machines.  The current authorization policy relies on Active Directory (peap-tls) and CCM (eap-tls).  Since the newly imaged machines will not be part of the domain yet they'll fail and will either be completely denied access or they'll be dropped into a null vlan. 

Would it be viable to create a policy that says if your name starts with the first 5 characters of our naming convention then you can be dumped onto the internal data VLAN and couple that with a DACL permitting access to ports necessary to join the domain? 

I'm not sure what type of security implications this would have?

If this is not a suitable route what would be a best practice approach?                  


ISE authorization policy question

You can do the later one if they fail authenticaton , they be granted separated Vlan with some defined access.