How to deny 1 AD Group wireless access

[nduckett2]

Hello all,

I am new to ISE and only have an eval license.  I am attempting to restrict access from a particular AD group from connecting to the wireless.

I am at the authorization policy, but do not see AD groups as a condition.  Do I need to make all the users of the AD group a User Identity Group first?  If so, is there a way to import this list from AD?

If I'm over complicating this, please let me know, but I haven't found anything specifically on this.

Thanks,

Nick

[hslai · Accepted solution]

Basically, three steps:

1. Join ISE to AD
2. Add AD Groups to ISE
3. Select the group condition in an authZ rule of a policy set.

Attached is a screen capture with ISE 2.4 showing the above steps.

Video Link : 17050

[nduckett2]

Not only was that a very prompt response, it was very detailed and accurate.

The issue I was facing was nothing was populating in the left hand side of the conditions field when I selected "user identity group" I would not have known to click on the right hand side if not for this video.

Thank you very much!

-Nick