Currently it seems  this is an ISE  1.1.x bug, you can use as a workaround in the ALL the dot1x  authorization profiles (Compliant and Not Compliant as well) this magic  Cisco  AV-Pairtermination-action-modifier=1this force the ISE to use the last au...

Currently it seems  this is an ISE 1.1.x bug, you can use as a workaround in the ALL the dot1x authorization profiles (Compliant and Not Compliant as well) this magic Cisco  AV-Pairtermination-action-modifier=1this force the ISE to use the last authe...