A bank merges two divisions into one ISE deployment with separate policy sets for wired, wireless and VPN access. Treasury VLAN and time-based exceptions must win over broad department rules, every session must close with an explicit restricted decision, and access must depend on which identity store authenticated the user. Which policy set ordering and authentication design meets all of these requirements?
Select an answer to reveal the explanation.
Short Explanation
You’ll want rules in first-match order: put Treasury VLAN and time-based exceptions before broad department rules, then end with an explicit restricted rule—like a final safety net. To make access depend on how you authenticated, use the authentication identity store in your authorization decisions.
Full Explanation
ISE evaluates policy sets top down and selects the first set whose condition matches. Within that set, the authentication policy runs; authorization rules are then evaluated top down until the first rule matches, applying that rule's profile, such as a downloadable ACL, VLAN or SGT. Authorization conditions can use authentication attributes, including the authentication identity store, to distinguish which store authenticated the user. Listing broad department rules first fails the specificity requirement because evaluation stops at that broad match, so the treasury and time-based exceptions beneath it never run. A permit rule at the top fails the restricted-decision requirement because it grants access before narrower conditions apply. Running the same AD-only authentication policy in every policy set fails the identity-store requirement if users must authenticate against different stores, because that policy does not authenticate against those other stores. Configure an explicit restricted catch-all authorization rule after the specific rules, and verify the matched rule in the live logs.