ISE 1.2 - Match Policy Set based on endpoint identity group?

Hello, I would like to create a condition that would force MAB'd clients to hit a certain policy set if their MAC address matches one in an endpoint identity group? Is this possible? I feel like a condition can be created using a combination of attributes, but I cannot seem to hit on it properly. Thanks.

The cleanest way to to this would be to dedicate:
1. (Wired) A test switch where all of your test devices are connecting. You can then build a policy set that matches against that NAS.
2. (Wireless) A test SSID and/or a controller (virtual or 2504). You can then build a policy set that is dedicated to that SSID
Thank you for rating helpful posts!

Similar Messages

AuthZ Policy using specific Endpoint Identity Groups

I am trying to create an AuthZ policy that will identify if a device is in specific Endpoint Identity Group. See policy below.
I used the IdentityGroup:Name attribute Equals the Identity Group MAB_Devices. Please note that there are NO Identity groups listed in the dropdown options, so I typed in the name. Alas, the rule is not working. Anyone have advise on what I am doing wrong? Thx

Bransomar, your screenshot is an Authentication policy rule but you should do it in Authorization policy. Authentication policy sorts out requests by request method and origin and assigns an identity store to each.

Did Cisco ISE have limitation for policy setting?

Deat All,
Did anyone know about Cisco ISE limitation about policy setting?
Right now my setting for windows posture policy around 200 windows patch checking, did ISE have limitation such as maximum windows patching policy line?
Thanks you
Best Regards

Here is the nswer for your first question.
Cisco ISE profiler collects a significant amount of endpoint data from the network in a short period of time. It causes Java Virtual Machine (JVM) memory utilization to go up due to accumulated backlog when some of the slower Cisco ISE components process the data generated by the profiler, which results in performance degradation and stability issues.
To ensure that the profiler does not increase the JVM memory utilization and prevent JVM to go out of memory and restart, limits are applied to the following internal components of the profiler:
Endpoint Cache—Internal cache is limited in size that has to be purged periodically (based on least recently used strategy) when the size exceeds the limit.
Forwarder—The main ingress queue of endpoint information collected by the profiler.
Event Handler—An internal queue that disconnects a fast component, which feeds data to a slower processing component (typically related to a database query).
For more information go through :
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_prof_pol.html#12624

ISE Endpoint Identity Group assignment for 802.1x clients

Hello
I'm using ISE 1.3 to 802.1x authenticate AD PC's (machine and user with Anyconnect NAM) and to profile/mab IP Phones, printers, APs etc.
Phones are profiled (EndPointSource of SNMPQuery Probe) and are placed automatically in the correct Identity Group.
AD PC's aren't profiled and are listed under Endpoints withthe Enpoint Profile of "unknown"
To place AD PC's into a particular Identity Group, I created a Radius Profiling Policy to match on the Framed-IP-Address. This works well with the AD PC appearing in the correct Identity Group (with EndPointSource of RADIUS Probe).
My questions are:
A phone (profiled with EndPointSource of SNMPQuery Probe) consumes a Plus licence but an AD PC ("profiled" with EndPointSource of RADIUS Probe) does not - is this correct?
Authenticated 802.1x AD PC's have other attributes (like AD-Host-Resolved-DNs) that I'd like to use to assign PC's to an Identity Group. I can't use these attributes with any of the ISE profilers - is there a way to assign an 802.1x authenticated client to an Identity Group at the authorisation stage rather than use the profiler?
Thanks
Andy

Err, no. There is no provision in EAP-TLS, PEAP (CHAP), or even basic EAP to provide network information (eg IP address/mask/gateway/DNS/etc).
There is also no provision in Windows 2k or XP interface management software to accept IP details for interface configuration via any wireless authentication protocol.
peter

Reassign endpoint identity group en masse in ISE

I imported a large number of endpoint identities and unfortunately some of them weren't correctly identified and I assigned them the wrong endpoint profile. The endpoints I need to move into another group all share a common OUI. Is it possible to move them all at once? I can't seem to find any way to do this.

Tom,
You can use the filter option in order to get the filter for the endpoints that are profiled incorrectly (perhaps the OUI you entered), check the select all option on the top left, and then export those endpoints. After you export the endpoints you can edit the group that you want to change them to, and then reimport this file back into ISE, this will change this back for you.
I just tested this in my setup and worked fairly well.
thanks,
Tarik Admani
*Please rate helpful posts*

ISE 1.3 Policy Set

We want to create a policy set that hits on a endpoint identity group. An endpoint identity group contains a bunge mac-address which we can't filter out with radius user-name match which work fine for a vendor hit.
Does anybody got an idea of this is possible?

You cannot create a "Policy Set" matching condition based on an endpoint identity group. You have to choose one of the available attributes. For instance, you can match against a NAD group or WLAN ID. Once inside the "Policy Set" you can create different authentication and authorization rules that can reference an endpoint group.
I hope this helps!
Thank you for rating helpful posts!

Cisco ISE: How to match an endpoint belong to an identity group ?

Hello,
I am running Cisco ISE 1.1.4.218 in a standalone environment.
I am trying to setup Compound Condition for Authorization.
I would like the condition to match the MAC address of the calling machine to the internal endpoint MAC address list.
I created 1 endpoint identity group and 2 children groups
- GroupParent
- ChildA
- ChildB
I put the MAC address of my machine in the group ChildA.
In my condition, I tried the following:
IdentityGroup:Name, Equals, ChildA
IdentityGroup:Name, Equals, GroupParent:ChildA
IdentityGroup:Name, Match, .*(ChildA).*
I even tried to put the MAC address in the GroupParent level and tried to update the condition to be:
IdentityGroupName, Equals, GroupParent
IdentityGroupName, Match, .*(GroupParent).*
But no one of these options worked.
I am almost sure that in Cisco ISE 1.1.1, it was working fine. But I updated today to 1.1.4 and I cannot make it work.
Can anyone help me ?
Best regards,
David

You could try the following to match only the parent group
IdentityGroup:Name EQUALS GroupParent
You could try the following to match only child group A
IdentityGroup:Name EQUALS GroupParent#ChildA
You could try the following to match all child groups of GroupParent
IdentityGroup:Name STARTS_WITH GroupParent
Please rate if this helps

ISE 1.2 Multi-Portal Identity Group Mapping

Hi,
Quick question regarding the use of Multi-Portal on ISE 1.2: Is it possible to map a single portal to a certain identity group? e.g. I have a portal for guest users, to which only users in the "ACME_guests" identity group can authenticate. I have a separate Portal for employees, where only users of the "ACME_employees" group can authenticate.
I know that I can specify a separate authentication sequence for each portal (e.g. internal, guests, AD), but I cant find a possibility to map a group to a certain portal. This has the consequence that e.g. guest users can log into the employee portal, and getting a successful authentication message. Of course I can further restrict the access in another policy rule, but this isnt a very neat solution.
Anybody have any ideas? It seems so basic that it has to be possible somehow?!
Regards

You can redirect users so they can "stick" to one portal once they have successfully authenticated. There is a document regarding device registration web authentication. Basically after a user connects successfully you can redirect them to an AUP specially designed to statically assign users to a specific endpoint identity group.
In the end if a user logs into portal A they hit the DRW and accept, ISE dumps them into a endpoint group called PortalA, you can then tie this into a policy where the PortalA endpoint is denied association to any other open ssid you have in your design.
Here is the document -
https://supportforums.cisco.com/docs/DOC-26667
Tarik Admani
*Please rate helpful posts*

ORA-00903: Invalid table name - running Set based mapping

Hello,
Using OWB 10.2.04.36 and have created a mapping which reads data from Non-Oracle, ODBC source table, actually a worksheet in an Excel workbook which has been defined/set up using the Heterogeneous Service components.
I can view the data in the worksheet using the Design Center, Data Object Editor, Data Viewer tab so I know the data is accessible.
The mapping is performing a Loading Type: INSERT/UPDATE into a View which has an INSTEAD OF INSERT OR UPDATE OR DELETE ON view.
The mapping validates okay and is deployed successfully.
Yet when it is run in "Set based" Operating Mode from Control Center Manager the Execution Results show an "ORA-00903: Invalid table name" error is raised.
You cannot run the mapping in any Row based operating mode as Row based running fails with "ORA:22816: Unsupported feature with RETURNING clause" due to the generated code for the INSERT/UPDATE of the view using a RETURNING clause which is actioned on an INSTEAD OF trigger.
Looking at the generated package code I can strip out the SELECT statement from the MERGE statement for the alias "MERGE_SUBQUERY" and it runs and displays the expected result, however when the complete MERGE statement is taken and run I get the same ORA-00903 error that was reported in Control Center Manager.
Any ideas what the problem could be? I have another mapping that reads from the same source Excel workbook/worksheet and INSERT/UPDATE into a table without an INSTEAD OF trigger, this mapping deploys, runs successfully so the issue seems to be with the INSERT/UPDATE into the view. The views are what we require to be populated.
Thanks.

Hi,
But changing V_EMP_DEPT to EMP is not INSERTING/UPDATING to the view V_EMP_DEPT, what you propose is INSERTING/UPDATING into the table EMP. The code was only an example showing that the MERGE does not work when INSERTING/UPDATING into a view based on joining tables. For example say you wanted to INSERT/UPDATE the DNAME of V_EMP_DEPT then the MERGE statement generated by OWB PL/SQL mapping would use the code structure/template:-
MERGE INTO "V_EMP_DEPT" "V_EMP_DEPT"
   USING (SELECT 5369 "EMPNO",
                 'SMITH' "ENAME",
                 'CLERK' "JOB",
                 7902 "MGR",
                 To_Date('17/12/1980','DD/MM/YYYY') "HIREDATE",
                 800 "SAL",
                 'New Dept Name" "DNAME"
          FROM   Dual,
                 "DEPT" "DEPT"
          WHERE ("DEPT"."DEPTNO" = 20)) "MERGE_SUBQUERY"
   ON (    "V_EMP_DEPT"."EMPNO" = "MERGE_SUBQUERY"."EMPNO")
   WHEN NOT MATCHED THEN
      INSERT("V_EMP_DEPT"."EMPNO",
             "V_EMP_DEPT"."ENAME",
             "V_EMP_DEPT"."JOB",
             "V_EMP_DEPT"."MGR",
             "V_EMP_DEPT"."HIREDATE",
             "V_EMP_DEPT"."SAL",
             "V_EMP_DEPT"."DNAME")
      VALUES("MERGE_SUBQUERY"."EMPNO",
             "MERGE_SUBQUERY"."ENAME",
             "MERGE_SUBQUERY"."JOB",
             "MERGE_SUBQUERY"."MGR",
             "MERGE_SUBQUERY"."HIREDATE",
             "MERGE_SUBQUERY"."SAL",
             "MERGE_SUBQUERY"."DNAME")
   WHEN MATCHED THEN
      UPDATE
         SET "ENAME" = "MERGE_SUBQUERY"."ENAME",
             "JOB" = "MERGE_SUBQUERY"."JOB",
             "MGR" = "MERGE_SUBQUERY"."MGR",
             "HIREDATE" = "MERGE_SUBQUERY"."HIREDATE",
             "SAL" = "MERGE_SUBQUERY"."SAL",
             "DNAME" = "MERGE_SUBQUERY"."DNAME";
{code}
This was only an example my target view has a lot more columns being MERGE'd into the view and joined tables.
Cheers,
Phil

Setting Default Outlook Signature By Group Policy

Hi
I am attempting to standardise our company's email signature for all users. A contact supplied me with a VBA script which generates a signature based on the user's AD information. This works great but I would like group policy to set this signature as default
to prevent users from making changes. From various Google searches, it seems that the default signature can be set by GP, but I can't seem to make sense of any of the posts that I find. This may be because I am new to GP and don't understand the context. Any
suggestions as to what would be the best way to approach this?
Thanks
Steve

Hi Steve_Flynn,
According to your description, you would like to set default Outlook signature using group policy. Right?
Based on my knowledge, the signature file is located in the path %userprofile%\AppData\Roaming\Microsoft \Signatures on Windows Vista, Windows 7, or Windows 8. And then we need to configure the related registry key
HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Common\MailSettings or
HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\x.0\Common\MailSettings.For more information, please refer to the following article:
How to deploy a default email signature in Outlook
http://support.microsoft.com/kb/2691977/en-us
We can deploy the signature file and configure the registry key via Group Policy to resolve the issue. For your information, please refer to the following article to learn more:
Configure a File Item
Configure a Registry Item
What's more, please refer to the following article to learn how to realize it via a script:
Setting Up Outlook E-Mail Signatures
Regards,
Lany Zhang

OWB 10.2.0.4 really bad set-based delete performance

Hi, we recently upgraded to OWB 10.2.0.4, with one of the reasons being the ability to do set-based deletes instead of row-based. However, upon testing this, we're seeing maps that in row based deletes go from 30 - 40 seconds, now taking literally 1.5 to 2 HOURS to run.
I expected the SQL from the set based to take the form of:
delete from my_table
where (col_a, col_b, col_c) in (select a, b, c from ....)
but instead the format is different:
delete from my_table
where exists (select 1 from ....)
I don't quite understand what the SQL is trying to accomplish - and truthfully, it performs horribly compared to the hand-written version (explain plan shows estimated cost of 14,000 for my query, and over 5 million for the OWB query).
Has anyone else seen this - and is there a solution? Part of me wants to say I'm doing something wrong, but the other part says "sure, but it works fine in row-based mode(target only)" - exact same map.
Any ideas?
Thanks!
Scott

Hi everyone, we'll I've figured out what is causing the problem and how to fix it...but still don't understand why it causes the problem.
Here's a high level overview of the ETL - we find deleted record by selecting business key columns from our existing dimension table and doing a MINUS on the matching columns from the source table. If any records come out of this, it means the record was deleted on the source, and we go ahead and do a matching delete on the dimension table.
Here's where the odd thing happens though - there's a column called "source system name" that is part of the dimension business key. This column does NOT exist on the source system - it's just a hard coded constant (put in just in case we ever add an additional system in the future).
Basically, if we do the minus logic on all the columns EXCEPT for this one, and then connect a constant to the delete operator that has this hard coded value in - the delete takes FOREVER... On the other hand, if we actually put this field into the minus operator by simply repointing the existing constant there instead of directly to the delete table...the deletes magically start taking 30 seconds instead of 10 minutes to run.
No idea (at all) why this makes a diff, but it seems to - and it's a day and night different.
Hopefully this can help someone else out who runs into the same issue.
Thanks!
Scott

Creation of a Marketing Profile Set based on the standard CRM_MKTTG_BP_BIRTHDATE Infoset thru the WebUI Segment Builder

Objective: Creation of a Marketing Profile Set based on the standard CRM_MKTTG_BP_BIRTHDATE Infoset thru the WebUI Segment Builder.
Problems: Standard CRM_MKTTG_BP_BIRTHDATE Infoset DOES NEVER RETURN ANY RESULTS on the segmentation builder of the WebUI client (no matter the filter you specify).
Other cases: However if we create a new Data source with data "Extraction from Query" (transaction RS02) based on this standard CRM_MKTTG_BP_BIRTHDATE Infoset and we test the functionality using transaction RSA3, IT DOES RETURN RESULTS (using the same filters as in the segmentation builder)! Of course the segmentation builder works with other attribute lists.
NEW: IF WE DON’T ESPECIFY ANY SEGMENTATION BASE IN THE PROFILE GROUP, IT DOES RETURN RESULTS!!! (GO TO THE END OF THE DOCUMENT FOR DETAILS)
Steps followed:
Review Standard Infoset CRM_MKTTG_BP_BIRTHDATE (Transaction SQ02).Review Data Reading Program code: do we have to change the standard code? We have only remove the "BREAK-POINT" statement.
Creation of a Data source based on the standard CRM_MKTTG_BP_BIRTHDATE Infoset (Transaction CRMD_MKTDS).
Creation of an Attribute List based on that standard Data source and selection the Birth date as a filter in the Attribute list (Transaction CRMD_MKTDS).
On the segment builder of the WebUI set any filter (Example: “TODAY”).
Steps in detail:
Review Standard Infoset CRM_MKTTG_BP_BIRTHDATE
SQ02.
(Image deleted)
Review Data Reading Program code (Code attached)
(Image deleted)
Creation of a Data source based on the standard CRM_MKTTG_BP_BIRTHDATE Infoset
Data source: Transaction: SPRO – Customer Relationship Management - Marketing – Segmentation - Maintain Data Sources and Attribute Lists: CRMD_MKTDS
Create Data Source
(Image deleted)
Infoset: CRM_MKTTG_BP_BIRTHDATE.
Business Partner Field: CRMT_MKTTG_IS_BIRTHDATE-PARTNER_GUID
(Image deleted)
Result:
(Image deleted)
Attribute List
Creation of the Attribute List
(Image deleted)
Assign Data Source:
(Image deleted)
Selection of the Birth date as a filter in the Attribute list:
(Image deleted)
Result:
(Image deleted)
Segment builder of the WebUI:
Access to WebUI with marketing role.
Create Segment:
Creation of Profile Set
Graphical modeler
Create Filter: We have already tried many different filters (we already seen notes referring to this matter).
Example1: “today”
Count target group. Here I would like to stand out that once you click on the “Count” option, immediately it shows 0 results. In other words, it doesn’t process any information. With other attribute lists it takes some time to process, no matter the filter or the attribute list you use. However if we create a new Data source with data "Extraction from Query" (transaction RS02) based on this standard CRM_MKTTG_BP_BIRTHDATE Infoset and we test the functionality using transaction RSA3, IT DOES RETURN RESULTS (with “today” filter and other)! So it seems that the problem has to do with the segment builder, not the Infoset.
Result: it never return any results no matter the filter you specify.
Other cases:
Creation of a new Data source with data "Extraction from Query" where you enter the name of your new query
Creation of a Data source based on the standard CRM_MKTTG_BP_BIRTHDATE Infoset
Standard Infoset CRM_MKTTG_BP_BIRTHDATE:
We fill the form and select “Extraction from Query”:
Press SAVE and define which fields will be available for selection and which of them will be visible.
RSA3: Extractor checker in order to test the Data source:
We specify the Data source:
IT DOES RETURN RESULTS:
ALV Grid:
NEW: It seems that it has to do with the Segmentation Basis selected in the creation of a Profile Set, because if we do not select any, it does return results. But we need to create this Profile Set based on a particular Segmentation Basis called BS Usuarios Registrados.
Segment builder – Profile Set of the WebUISegmentation Basis: we leave it in blanc.
Graphical modeler
Create Filter: We have already tried many different filters (we already seen notes referring to this matter).
Example1: “today”
Count target group.
Result: IT DOES RETURN RESULTS!!! àConclusion: the problem is the Segmentation Basis
Define Segmentation Basis:
Transaction: SPRO – Customer Relationship Management - Marketing – Segmentation – Classic Segmentation - Define Segmentation Basis.BS Usuarios Registrados:
Define Reports for Creating Segmentation Bases
Transaction: SPRO – Customer Relationship Management - Marketing – Segmentation – Classic Segmentation - Define Reports for Creating Segmentation BasesZMK_UTL_MGR_SITES_UREG
Define Usage for Segments:
Transacción: SPRO – Customer Relationship Management - Marketing – Segmentation – General Settings - Define Usage for Segments.ZBS_UR à02 Segmentatión Basis
Attribute List:Category:
There is no Category 02 Segmentatión Basis!!! Why?? Why is not posible to select Category 02 Segmentation Basis in the creation of the Attribute List???
Usage ID
NEW: It seems that it has to do with the Segmentation Basis selected in the creation of a Profile Set, because if we do not select any, it does return results. But we need to create this Profile Set based on a particular Segmentation Basis called BS Usuarios Registrados. Why is not posible to select Category 02 Segmentation Basis in the creation of the Attribute List???

It seems that the standard Infoset doesn’t work by itself with Segmentation Basis. Two SAP notes have been applied and a new Field Group has been added to the Infoset (in order to distint the Segmentation Base).
CRMT_MKTTG_IS_BIRTHDATE-MGRGUID
1966298: MGR_GUID is not populated correctly to infoset read program
2007687:Segmentation InfoSet queries saved with incorrect Master Group
For that reason we had to create a new Infoset based on the standard CRMT_MKTTG_IS_BIRTHDATE, but adding this new Field MGRGUID to the Group Fields.
Issue solved

Can Data Links be established between Data sets based on View Objects?

Hi all,
In the BI Publisher Documentation it's given that Datasets based on view object queries do not support Data Links / Group Links. We found out that only way to establish relationship between view object Datasets is to create a view link and then upload it to create a Dataset.
1. Is there any other way to establish relationship between view objects Datasets in DataModel editor itself just as in the case of data sets based on (SQL queries e.t.c.)?
2. If so can View object Datasets be linked to Datasets based on other Datasources?
3. Will the Datalinks for View object Datasets be supported in any of the upcoming releases. Is there any ER logged for this case?
Any insight on the above issues will be really helpful.
Thanks

Enhance the data source with date and time and populate these fields in the user exit using the function module IB_CONVERT_FROM_TIMESTAMP .
OR
You can create Z function module IB_CONVERT_FROM_TIMESTAMP in BW side and write a routine in update rules/transfer rules to populate date and time.
hope this helps ...
Ravi

HT204406 iTunes Match was set up but wouldn't download any of my music. I turned iTunes Match off, deauthorised and then reauthorised, restarted iTunes. Now iTunes match won't turn on - I get the "Add this computer screen" but it says can't add for 83 day

iTunes Match was set up on my new MacBook Pro. Today, it wouldnt download any of my music, so I followed advice, switched on iTunes Match and switched it on again. When this didnt help, I deauthorized the computer, logged out of iTunes, and relogged in again. I have reauthroized the computer and reset the View/Options.
However, now I cant connect to iTunes Match or iCloud at all. The screen asking me to Add this computer comes up, when I click and enter my Mac account details I get the error message:
"You can use iTunes Match on this computer with just one Apple ID every 90 days. You cannot associate this computer with a different Apple ID for 83 days."
However, this was the iTunes account with which I set up iTunes Match.
Anyone got any suggestions?

Hey Carolefromthelou,
The following link will provide steps on how to best remove all traces of iTunes from your PC and then reinstall it:
Removing and reinstalling iTunes and other software components for Windows Vista, Windows 7, or Windows 8
http://support.apple.com/kb/HT1923
Welcome to Apple Support Communities!
Best,
Delgadoh

Windows 7 desktop locks after 10 minutes idle - Policy setting?

Is there a policy setting to lock the desktop after a certain amount of idle time? I can't seem to find one, and searches on the web only seem to uncover lock up issues with software, rather than security policy settings.
Right now our Win 7 desktops lock after 10 minutes of inactivity (set by old IT staffer who is no longer here). This is way too short and we need to change it. However, I can't find where the setting is. The screensaver is disabled and the power settings are set to maximum. The only policy setting that looks like it could be what I'm looking for is "Microsoft network server: Amount of idle time required before suspending session", but that wasn't set to 10. I went and set it to 0 anyway and the desktop still locks after 10 mins.
Can someone point me in the right direction for this setting?
Thanks!

When you leave your computer, it’s best to start a screensaver that can only be turned off with a password.
On the Start menu, click Control
Panel.
Click Personalization, and then click Screen
Saver.
In the Wait box, choose 15 minutes
(or less)
Click On resume, display logon screen, and then click OK.
just try reverse , it may work !!!!!!!!!!!!! :)

ISE 1.2 - Match Policy Set based on endpoint identity group?

Similar Messages

Maybe you are looking for