Dear community,
I just tested group policy which integrate with Cisco ISE, I notice that sometime it match not properly. Sometime it match the group policy that wish to apply, sometime it match default or not automatic move from one group policy group base on authorization requirement. I have opened case with TAC as well but they said configuration all fine.
If you have the same experience, please kindly share the solutions or any resource configuration both Meraki MR and Cisco ISE.
Thanks,
Makara MEAS.
Solved! Go to solution.
Is this for a 802.1x or something else, like a splash page?
802.1x does not have access to anything prior to authentication, in any environment, Meraki or otherwise. You have to authenticate just to get an IP address.
If this is some kind of splash page setup, you would have default global rules allowing access to AD/DNS, and then have the user authenticate, and then push a group policy with the new group policy to use with the new access rules.
It's not clear to me what method you are using, but perhaps these Meraki guides might be of help (the first is using MAC bypass, the second is using WPA2-Enterprise mode):
https://documentation.meraki.com/MR/Encryption_and_Authentication/Device_Posturing_using_Cisco_ISE
cool nas
How?
Yerng chea pi na ke ?
@MakaraMEAS the ACL on Cisco ISE and Group Policy on Meraki Dashboard has to have the same name.
I got you, it require the same name. But in testing environment it is not smooth to rollout for production.
From your experience it is working fine?
Yep, It has been working fine. 🙂
Okay cool, maybe my configuration issue with MR.
We design (802.1x) group policy for authentication and authorization like below:
authentication: group policy permit only access to AD/DNS only
after authentication success:
authorization: group policy permit specific destination/service.
You know when it move from authentication to full authorization sometime not smooth.
Is this for a 802.1x or something else, like a splash page?
802.1x does not have access to anything prior to authentication, in any environment, Meraki or otherwise. You have to authenticate just to get an IP address.
If this is some kind of splash page setup, you would have default global rules allowing access to AD/DNS, and then have the user authenticate, and then push a group policy with the new group policy to use with the new access rules.
It's not clear to me what method you are using, but perhaps these Meraki guides might be of help (the first is using MAC bypass, the second is using WPA2-Enterprise mode):
https://documentation.meraki.com/MR/Encryption_and_Authentication/Device_Posturing_using_Cisco_ISE
Thank you, your link is useful for me.
I just wonder why it sometime not switch from one rule to one rule not properly. sometime it match to general group policy, which is not the requirement.