ISE 1.3 not allow authentication based on the group network

ISE 1.3

MS AD 2008R2

Two groups: all employees, all students

Problem: Students employee network connection

I have two wireless networks, STUDENTS and EMPLOYEES. In ISE, I have two strategies for approval for these networks. In an effort prior to keep students to connect to the network employee, I set the permission policy:

Employee: If (Wireless_802.1X AND AD1:ExternalGroups is equal to mydomain/accounts/all employees AND the AD1:ExternalGroups NOT_EQUALS mydomain/students/all students) then: Employee_Profile

Unfortunately, it did not work. Students have their own username and password in AD and each faculty and staff member. I checked that students are using their identification and employee network connection information. Conversely, I can connect to the student network using the credentials of the employee. The main problem is with the students, employee network, they use all the applicable DHCP scope addresses.

I need to not allow the network connection used by students and the network of students by employees.

Any help would be appreciated!

Kevin

Glad you were able to solve your problem! Also thank you for taking the time to come back and share the solution with everyone (+ 5) to me.

If your problem is resolved, you must mark the thread as "answered":) ".

Tags: Cisco Security

Similar Questions

  • Avoiding PC not allowed to connect to the wireless network

    AA: For wireless in our establishment, we have access Points on all floors that are in turn connected to the main server PC.
    When I opened the "wireless network connection state", click 'Wireless properties', then select 'Security', it shows the following:
    Security type: no authentication (Open)
    Encryption type: WEP
    Network security key *.
    When the "Show characters" checkbox is selected, it shows the "network security key.
    Is it possible that this security key can be hidden and therefore not visible at all. This avoids computers are not allowed to connect to the network.
    All PCs are loaded with windows 7.
    BB: All PC's are connected WIFI and their IP 192.168.1.100 to 120 with the subnet mask 255.255.255.0 range
    I need to connect some of the connected WLAN PC also by a connection to the local network for networking with a Satellite Communicator for internet connection.
    Setting regarding address LAN IP for the PC, I can give them the same IP from 192.168.1.121 to XXX or if IP address
    address be 192.168.0.xxx
    Adv. kindly

    Change in WPA2.
    Put a password on that isn't easy to guess and is greater than 8 characters.
     
    The security key you are watching is on your computer - you have entered it or allowed him to be registered.  Except if you give someone access to that computer (or a similar) they will not be able to get to this part of the system to see what you see.  If you give people access to the use of these systems, do not give them administrative access - they must only use computers as * users *.

  • authentication based on the host: < - address of the host > is ignored

    Hi guys,.

    I try authentication based on the host to the cluster nodes. but the nodes are not authenticated at all, even a knot on a host not specified in the configuration is joining the cluster and newspapers are absolutely perfect. Can't understand why <-host address > is ignored?

    Here is my config:
    <coherence xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.oracle.com/coherence/coherence-operational-config"
         xsi:schemaLocation="http://xmlns.oracle.com/coherence/coherence-operational-config coherence-operational-config.xsd">
    
         <cluster-config>  
         <unicast-listener>
                   <well-known-addresses>                 
                      <socket-address id="1"><address>10.152.21.52</address><port>31760</port></socket-address>
                      <socket-address id="2"><address>10.152.21.53</address><port>31760</port></socket-address>
                      <socket-address id="3"><address>10.152.21.54</address><port>31760</port></socket-address>
                        <socket-address id="4"><address>10.152.21.55</address><port>31760</port></socket-address>
                 </well-known-addresses>     
         <address>localhost</address> 
               <port>31760</port>         
             </unicast-listener>      
         <authorized-hosts>               
                         <host-address id="1">10.152.21.52</host-address>
             <host-address id="2">10.152.21.53</host-address>
             <host-address id="3">10.152.21.54</host-address> 
                    <!-- <host-range>
                         <from-address>10.152.21.52</from-address>
                         <to-address>10.152.21.55</to-address>
             </host-range> -->
         </authorized-hosts> 
           </cluster-config>       
           <configurable-cache-factory-config>
                <class-name>com.oracle.coherence.environment.extensible.ExtensibleEnvironment</class-name>
              <init-params>
                          <init-param>
                              <param-type>java.lang.String</param-type>
                              <param-value>ccoe-cache-config.xml</param-value>
                          </init-param>
                </init-params>
             </configurable-cache-factory-config>
    </coherence>
    However, if I use <-host range > instead of <-host address > it works quite well and trying to reach any node a host outside the specified range cluster it gets and exception 'this member is not allowed to join the cluster' as expected.

    Any ideas why <-host address > is completely ignored? I'm misssing something stupid?

    Thank you
    D

    Hi D,

    It looks like a bug in consistency for me due to the fact that the tangosol - default coherence.xml file contains an empty host range in the section authorized hosts. Even if you overloaded authorized hosts this empty beach is always included in the Cluster configuration, then the class that reads this part of the configuration is messed up.

    Specifically, in your case, the XML from your substitution file combined with the default settings in tangosol - coherence.xml would look like this...

    
        
            
            
                
                
            
            10.152.21.52
            10.152.21.53
            10.152.21.54
        
    
    

    .. .who processing does not create a filter to authorized hosts.

    Here's a test case...

    String XML = "" +
            "    " +
            "        " +
            "        " +
            "            " +
            "            " +
            "        " +
            "        10.152.21.52" +
            "        10.152.21.53" +
            "        10.152.21.54 " +
            "    " +
            "";
    
    XmlDocument xml = XmlHelper.loadXml(XML);
    LegacyXmlClusterDependencies deps = new LegacyXmlClusterDependencies();
    deps.fromXml(xml);
    Filter authHostsFilter = deps.getAuthorizedHostFilter();
    // Oops... authHostsFilter is null!
    

    If you delete the Virgin beach of the XML in the test and run again you get a filter.

    JK

    Published by: Jonathan.Knight on February 8, 2012 11:55

  • ASA VPN - allow user based on LDAP Group

    Hello friends

    I have create a configuration to allow connection based on LDAP Group.

    I m not specialize in the firewall and I tried to follow the links above, but both seem old, commanded several is not available.

    http://www.tunnelsup.com/Cisco-ASA-VPN-authorize-user-based-on-LDAP-group

    http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

    Anyone know how I can do?

    Thank you

    Marcio

    I like to use the Protocol DAP (dynamic access policies) to control this.  Follow this guide:

    https://supportforums.Cisco.com/document/7691/ASA-8X-dynamic-access-policies-DAP-deployment-guide

  • I try to install the progrsm Fixit and it does not allow me to make the race he leaves on the download

    original title: installation FIXIT

    I try to install the progrsm Fixit and it does not allow me to make the race he leaves on the download?

    Hello

    1. What operating system do you work?
    2. What Fix - it you are trying to install?
    3. What version of internet explore do you use?

    Please refer to the below link mentioned before asking your question so that you can provide all the relevant information for us to help you:

    http://support.Microsoft.com/kb/555375

    You can try the following:

    Remove temporary internet files

    http://Windows.Microsoft.com/en-us/Windows7/delete-files-using-disk-cleanup

    Also try to save the file on your computer, then run it.

  • My Wireless Mobile Mouse 3500 driver does not allow me to control the scrolling of the wheel

    My Wireless Mobile Mouse 3500 driver does not allow me to control the scrolling of the wheel. When I scroll it will only pages and no option available for the adjuments to go through all the 3 lines or more. I thought that I had downloaded the wrong driver but the mouse did not bring a CD or another. Returned to download the specific driver and still can't get in there.

    Hello

    1 have you made changes to your computer recently?

    If the mouse works well, if a setting should be changed the mouse in the intellipoint software, you can contact the manufacturer of the device for more assistance.

    http://www.Microsoft.com/hardware/en-us/support

    For more information you can check the link below.

    Troubleshoot the incidents of the response to the mouse or wireless keyboard

    http://support.Microsoft.com/kb/838398

    Concerning

  • I can´t download cloud creative, because a window that says error 204 appears, but I Don t know what file does not allow me to download the program or file is Miss

    I can´t download cloud creative, because a window that says error 204 appears, but I Don t know what file does not allow me to download the program or file is Miss

    Error 204 https://forums.adobe.com/thread/1492846

  • I am a regular user of Adobe Story CC Plus (free Web Version), and since yesterday it is not allow me to export the document to PDF.

    I am a regular user of Adobe Story CC Plus (free Web Version), and since yesterday it is not allow me to export the document to PDF.

    I can't select the buttons to drop down, however there no file was created (I also check it for Excel)

    However is not working for her also, please think!

    Can you please try another browser, firefox for example? Is this the same?

  • Error when parsing the file ' value of the 'src' attribute is not valid; must be a URI'.  ERROR (RSC-005) to "Hetgeheimfietsen.epub/OEBPS/toc.xhtml" (line 10, col 10): error while parsing the file ' "ol" element not allowed here; wait for the end-tag of t

    The members of the Forum kan help you

    Validation by using version 3.0.1 EPUB rules.

    ()https://github.com/IDPF/epubcheck( )

    December 9, 2015 15:27:33 THIS

    ---------------------------------------------------

    WARNING (OPF-007) to 'Hetgeheimfietsen.epub/OEBPS/content.opf' (line 2, column 227):

    Re-declaration of prefix reserved "rendition."

    ERROR (RSC-005) to "Hetgeheimfietsen.epub/OEBPS/toc.xhtml" (line 10, col 10):

    Error when parsing the file ' "ol" element not allowed here; waiting for the end-tag of the element or element "li" '.

    WARNING (CSS-007) to "Hetgeheimfietsen.epub/OEBPS/css/idGeneratedStyles_0.css" (line 60, col 2):

    Police made OEBPS/font/CambriaMath.ttc refers to fonts not standard type application/x-police-FTT.

    WARNING (PKG-012) to "Hetgeheimfietsen.epub/OEBPS/De_Alpe_d'Huez-1.xhtml":

    File name contains following non ascii characters: '. You want to change the name of the file.

    WARNING (PKG-012) to "Hetgeheimfietsen.epub/OEBPS/De_Alpe_d'Huez-2.xhtml":

    File name contains following non ascii characters: '. You want to change the name of the file.

    Check the finish with warnings or errors!

    In the file Toc delete the second "ol", as well as closing like Epubcheck duplicate codes

        the one after the other (delete the other)

    1. Accidentally, I saved a PDF file in the cloud and can't be deleted from there. Help, please. I've upgraded to Adobe Acrobat Reader DC and it does not allow me to save the scans on my computer.

      Accidentally, I saved a PDF file in the cloud and can't be deleted from there. Help, please. I've upgraded to Adobe Acrobat Reader DC and it does not allow me to save the scans on my computer.

      Or simply open CD player

      Go to the Home tab then Document Cloud

      Click on the PDF file to be removed

      Click on remove in the top

    2. Downloaded Camera Raw plugin 9.1, but 13 elements still does not allow me to open the raw files from Nikon D750

      Downloaded Camera Raw plugin 9.1, but 13 elements still does not allow me to open the raw files from Nikon D750. Why?

      Did you install that you downloaded?

    3. do not allow me to convert the PDF to exel

      It is not allowing me to convert the PDF to exel.  send me Web site to select the product... when I do it, says I'm already registered and does not allow me to continue

      Hi daniar69975146,

      Please make sure that you use last DC of Adobe Acrobat Reader Acrobat Reader DC Learn & Support to use the service to export it to PDF help of Acrobat Reader | Export PDF to Acrobat Reader DC, as the old version or player that is more compatible with Acrobat online services.

      You can also use this service online at https://cloud.acrobat.com/exportpdf

      I would like to know if it works.

      Kind regards

      Nicos

    4. content tool text does not allow me to adjust the attributes of individual word

      content tool text does not allow me to adjust the attributes of individual word

      You should be able to do all those without a problem...

      This screenshot I did all those you mentioned and the italics and underscore.

    5. My renewal date is 6/28/15...My monthly bill was $42,39... and is now $74.19!... I have not allowed an upgrade, including the! I need my excess refund immediately!

      My renewal date is 6/28/15...My monthly bill was $42,39... and is now $74.19!... I have not allowed an upgrade, including the! I need my excess refund immediately! @

      Since this is an open forum, not Adobe support... you must contact Adobe personnel to help
      Chat/phone: Mon - Fri 05:00-19:00 (US Pacific Time)

      Creative cloud support (all creative cloud customer service problems)
      http://helpx.Adobe.com/x-productkb/global/service-CCM.html

    6. "Save as" box pop up does not allow me to save the document.

      Hello

      "Save as" box pop up does not allow me to save the document. Displays a white screen. No idea what would cause this? I bought acrobat pro dc.

      Thank you!

      Found this solution:

      The default "Save as" dialog Acrobat DC is different from the dialogue box you had in earlier versions of Acrobat, it also allows you to record in the clouds and previous locations that you saved the files. It is possible that when Acrobat tries to connect to the 'cloud', it runs into problems. You can try to disable this feature to see if this brings your backup in the back of the box: open Acrobat Preferences, then go to the "General" category and uncheck "show the online storage when you save files:

    Maybe you are looking for