ISE policy, DACLs and VLAN changes together

Question

So I have been having a hard time finding consistency in a policy that both changes the VLAN and applies a DACL. Originally, I found out that remarks were causing it to mess up. But I can't find any consistency. I can use the vanilla 'oermit all' DACL in ISE, along with a VLAN change, and it just doesn't work. My AuthZ is very simple...If you are wired_MAB and your endpoint is in a particular group, then apply a policy that changes the VLAN and applies a DACL. This seems like it's at the root of what ISE is supposed to do, but it seems so buggy. Weird thing is, that if I do the VLAN change by itself, it works. But when I add the DACL neither work. Anyone have any ideas as to why this is?

Answer 1

So it worked this time. The machine has been sitting in sleep mode for a while now. This is so inconsistent. Could it have something to do with me using the same machine to test a few different policies? I'm just switching the machine's MAC between different groups in order to test different policies. Thats really when it stops working.
- Do you have a pre-auth acl configured already on the port ? Yes, one that says permit any any
- Is the port running open mode ? Yes
- What does the "show auth sess int x/x" tell you once the ise has sent the authorization result to the switch ?
SJ5051IDF1#show authentication sess int g1/5 d
            Interface:  GigabitEthernet1/5
          MAC Address:  d4be.d905.3973
         IPv6 Address:  Unknown
         IPv4 Address:  10.42.163.59
            User-Name:  D4-BE-D9-05-39-73
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
     Oper control dir:  both
      Session timeout:  N/A
    Common Session ID:  0A0600210000007B24636E88
      Acct Session ID:  0x00000086
               Handle:  0x4A000055
       Current Policy:  POLICY_Gi1/5
Local Policies:
Template: DEFAULT_LINKSEC_POLICY_SHOULD_SECURE (priority 150)
      Security Policy:  Should Secure
      Security Status:  Link Unsecure
Server Policies:
           Vlan Group:  Vlan: 1620
              ACS ACL:  xACSACLx-IP-BLDG-AUTOMATION-DACL-52fa7487
Method status list:
       Method           State
       mab              Authc Success
interface GigabitEthernet1/5
switchport access vlan 32
switchport mode access
switchport voice vlan 64
ip access-group ACL-ALLOW in
logging event link-status
authentication event fail action next-method
authentication event server dead action authorize vlan 2700
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
service-policy input QoS-Input-Policy
service-policy output QoS-Host-Port-Output-Policy
end