Wired Intelligent Edge

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.

is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?

or is this not possible at all?

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.

What you normally would do is trigger a 'Terminate Session', where the switch will do a new authentication for the user/device and you can then return the new role/DACL as part of your policy/enforcement.

I'm not sure if ISE support DACL for Aruba switches, but you may fallback to user roles and return a local user role.

is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?

or is this not possible at all?

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.

Hi Herman,

Yes i have configure DACL from ISE to ARUBA switches and its working perfectly but i need to do changes of the DACL and i havent figure out how to do that.(use vsa 92 standard by the way) if you need the config just let me do a session withb the cliente to do screenshot of ise and the config of the switch(the hardest part was to send the client ip address to ISE).

With the COA 'Terminate Session' if you have the experience with Cisco ISE could you show me how that configuration of the terminate session goes, i havent got that part i still have doubts with that configuration.

Saludos,

Gerardo Andree Mejia 

What you normally would do is trigger a 'Terminate Session', where the switch will do a new authentication for the user/device and you can then return the new role/DACL as part of your policy/enforcement.

I'm not sure if ISE support DACL for Aruba switches, but you may fallback to user roles and return a local user role.

is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?

or is this not possible at all?

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.

You can initially deploy user role with policy and assign different user role having different policy based on your requirement using reauthentication CoA as below

Hi Herman,

Yes i have configure DACL from ISE to ARUBA switches and its working perfectly but i need to do changes of the DACL and i havent figure out how to do that.(use vsa 92 standard by the way) if you need the config just let me do a session withb the cliente to do screenshot of ise and the config of the switch(the hardest part was to send the client ip address to ISE).

With the COA 'Terminate Session' if you have the experience with Cisco ISE could you show me how that configuration of the terminate session goes, i havent got that part i still have doubts with that configuration.

Saludos,

Gerardo Andree Mejia 

What you normally would do is trigger a 'Terminate Session', where the switch will do a new authentication for the user/device and you can then return the new role/DACL as part of your policy/enforcement.

I'm not sure if ISE support DACL for Aruba switches, but you may fallback to user roles and return a local user role.

is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?

or is this not possible at all?

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.

so i can add the:

and send that information on the reauthenticate for the Aruba siwtches rigth?

i think i gettoting so what you do on the definition of the ISE is defines de VSA that im going to send the switch rigth?

thanks for the help by the way.

You can initially deploy user role with policy and assign different user role having different policy based on your requirement using reauthentication CoA as below

Hi Herman,

Yes i have configure DACL from ISE to ARUBA switches and its working perfectly but i need to do changes of the DACL and i havent figure out how to do that.(use vsa 92 standard by the way) if you need the config just let me do a session withb the cliente to do screenshot of ise and the config of the switch(the hardest part was to send the client ip address to ISE).

With the COA 'Terminate Session' if you have the experience with Cisco ISE could you show me how that configuration of the terminate session goes, i havent got that part i still have doubts with that configuration.

Saludos,

Gerardo Andree Mejia 

What you normally would do is trigger a 'Terminate Session', where the switch will do a new authentication for the user/device and you can then return the new role/DACL as part of your policy/enforcement.

I'm not sure if ISE support DACL for Aruba switches, but you may fallback to user roles and return a local user role.

is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?

or is this not possible at all?

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.

Yes we could send NAS-Filter-Rule via CoA.  

so i can add the:

and send that information on the reauthenticate for the Aruba siwtches rigth?

i think i gettoting so what you do on the definition of the ISE is defines de VSA that im going to send the switch rigth?

thanks for the help by the way.

You can initially deploy user role with policy and assign different user role having different policy based on your requirement using reauthentication CoA as below

Hi Herman,

Yes i have configure DACL from ISE to ARUBA switches and its working perfectly but i need to do changes of the DACL and i havent figure out how to do that.(use vsa 92 standard by the way) if you need the config just let me do a session withb the cliente to do screenshot of ise and the config of the switch(the hardest part was to send the client ip address to ISE).

With the COA 'Terminate Session' if you have the experience with Cisco ISE could you show me how that configuration of the terminate session goes, i havent got that part i still have doubts with that configuration.

Saludos,

Gerardo Andree Mejia 

What you normally would do is trigger a 'Terminate Session', where the switch will do a new authentication for the user/device and you can then return the new role/DACL as part of your policy/enforcement.

I'm not sure if ISE support DACL for Aruba switches, but you may fallback to user roles and return a local user role.

is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?

or is this not possible at all?

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.

Hi Shobana, 

i had problem with the COA re-authenticate

this is the configuration i put on the ISE profile and sitll got no response from the switch

do you see anything bad in there??

am going to add the config of the switch i dont know if maybe theres something else that need to be done.

thanks for the help.

Yes we could send NAS-Filter-Rule via CoA.  

so i can add the:

and send that information on the reauthenticate for the Aruba siwtches rigth?

i think i gettoting so what you do on the definition of the ISE is defines de VSA that im going to send the switch rigth?

thanks for the help by the way.

You can initially deploy user role with policy and assign different user role having different policy based on your requirement using reauthentication CoA as below

Hi Herman,

Yes i have configure DACL from ISE to ARUBA switches and its working perfectly but i need to do changes of the DACL and i havent figure out how to do that.(use vsa 92 standard by the way) if you need the config just let me do a session withb the cliente to do screenshot of ise and the config of the switch(the hardest part was to send the client ip address to ISE).

With the COA 'Terminate Session' if you have the experience with Cisco ISE could you show me how that configuration of the terminate session goes, i havent got that part i still have doubts with that configuration.

Saludos,

Gerardo Andree Mejia 

What you normally would do is trigger a 'Terminate Session', where the switch will do a new authentication for the user/device and you can then return the new role/DACL as part of your policy/enforcement.

I'm not sure if ISE support DACL for Aruba switches, but you may fallback to user roles and return a local user role.

is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?

or is this not possible at all?

Hi Created,

This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.