Cisco Ise 13 User Guide

CHAPTER 30
Policy User Interface Reference
•Authentication,page815
•AuthorizationPolicySettings,page818
•EndpointProfilingPoliciesSettings,page819
•Dictionaries,page823
•Conditions,page825
•Results,page836
Authentication
Thissectiondescribestheauthenticationpolicypage,whichallowsyoutoconfiguresimpleandrule-based
authenticationpolicies.
Simple Authentication Policy Configuration Settings
Thefollowingtabledescribesthefieldsinthesimpleauthenticationpolicypage,whichallowsyoutoconfigure...

Usage GuidelinesFields
Defineafurthercourseofactionforauthenticationfailure,usernotfound,or
processfailureevents.Youcanchooseoneofthefollowingoptions:
•Reject—Arejectresponseissent.
•Drop—Noresponseissent.
•Continue—CiscoISEproceedswiththeauthorizationpolicy.
Options
Related Topics
SimpleAuthenticationPolicies,onpage412
SimpleAuthenticationPolicyFlow,onpage413
GuidelinesforConfiguringSimpleAuthenticationPolicies,onpage414
ConfigureaSimpleAuthenticationPolicy,onpage427
Rule-Based Authentication Policy...

Usage GuidelinesFields
Clicktheplus[+]signtoexpandtheConditionsanchoredoverlay,andclickthe
minus[-]sign,orclickoutsidetheanchoredoverlaytocloseit:
•SelectExistingConditionfromLibraryorCreateNewCondition
(AdvancedOption)
•SelectExistingConditionfromLibrary—Youcandefineanexpression
byselectingCiscopredefinedconditionsfromthepolicyelementslibrary.
•CreateNewCondition(AdvancedOption)—Youcandefineanexpression
byselectingattributesfromvarioussystemoruser-defineddictionaries.
Conditions
Youcandothefollowing:...

Usage GuidelinesFields
Youcandothefollowing:
1Youcanaddad-hocattribute/valuepairstoyourexpression,andthenusean
ANDorORoperatortoaddmultipleconditions.
2ClicktheActionicontodothefollowinginthesubsequentsteps:
•AddAttribute/Value—Youcanaddad-hocattribute/valuepairs
•AddConditionfromLibrary—YoucanaddCiscopredefinedconditions
•Duplicate—Createacopyoftheselectedcondition
•AddConditiontoLibrary—Youcansavead-hocattribute/valuepairs
thatyoucreatetothepolicyelementslibrary...

Table 107: Authorization Policy Settings
Usage GuidelinesFields
Chooseoneofthefollowingtoenforcethepolicies:
•Enabled—Thispolicyconditionisactive.
•Disabled—Thispolicyconditionisinactiveandwillnotbeevaluated.
•MonitorOnly—Thispolicyconditionwillbeevaluated,buttheresultwill
notbeenforced.Youcanviewtheresultsofthispolicyconditioninthe
LiveLogauthenticationpage.Inthis,seethedetailedreportwhichwill
havethemonitoredstepandattribute.Forexample,youmaywanttoadd...

Usage GuidelinesFields
Bydefault,thePolicyEnabledcheckboxischeckedtoassociateamatching
profilingpolicywhenyouprofileanendpoint.
Whenunchecked,theendpointprofilingpolicyisexcludedwhenyouprofilean
endpoint.
PolicyEnabled
Entertheminimumvaluethatyouwanttoassociatewiththeprofilingpolicy.
Thedefaultvalueis10.
MinimumCertainty
Factor
Chooseanexceptionaction,whichyouwanttoassociatewiththeconditions
whendefiningaruleintheprofilingpolicy.
ThedefaultisNONE.Theexceptionactionsaredefinedinthefollowinglocation:...

Usage GuidelinesFields
Checkthischeckboxtoassignendpointstothematchingparentendpointidentity
groupusinghierarchicalconstructionofprofilingpoliciesandidentitygroups.
Thisoptionallowsyoutomakeuseoftheendpointprofilingpolicieshierarchy
toassignendpointstooneofthematchingparentendpointidentitygroups,as
wellastotheassociatedendpointidentitygroupstotheparentidentitygroup.
Forexample,endpointsthatmatchanexistingprofilearegroupedunderthe
appropriateparentendpointidentitygroup.Here,endpointsthatmatchthe...

Usage GuidelinesFields
Clicktheplus[+]signtoexpandtheConditionsanchoredoverlay,andclickthe
minus[-]sign,orclickoutsidetheanchoredoverlaytocloseit.
ClickSelectExistingConditionfromLibraryorCreateNewCondition
(AdvancedOption).
SelectExistingConditionfromLibrary---Youcandefineanexpressionby
selectingCiscopredefinedconditionsfromthepolicyelementslibrary.
CreateNewCondition(AdvancedOption)---Youcandefineanexpressionby
selectingattributesfromvarioussystemoruser-defineddictionaries....

Usage GuidelinesFields
Youcandothefollowing:
•Youcanaddad-hocattribute/valuepairstoyourexpression,andthenuse
anANDorORoperatortoaddmultipleconditions.
•ClicktheActionicontodothefollowinginthesubsequentsteps:
◦AddAttribute/Value—Youcanaddad-hocattribute/valuepairs
◦AddConditionfromLibrary—YoucanaddCiscopredefined
conditions
◦Duplicate—Createacopyoftheselectedcondition
◦AddConditiontoLibrary—Youcansavead-hocattribute/valuepairs
thatyoucreatetothepolicyelementslibrary...

Usage GuidelinesFields
Chooseoneofthefollowingdatatypesforthevendorspecificattribute:
•STRING
•OCTET_STRING
•UNIT32
•UNIT64
•IPV4
DataType
CheckthischeckboxtoenablethecomparisonofRADIUSattributeasMAC
address.Bydefault,fortheRADIUSattributecalling-station-idthisoptionis
markedasenabledandyoucannotdisableit.Forotherdictionaryattributes(of
stringtypes)withintheRADIUSvendordictionary,youcanenableordisable
thisoption.
Onceyouenablethisoption,whilesettingtheauthenticationandauthorization...