Cisco · ISE 3.3 · Lesson 9 of 12

Authorization result: VLAN, dACL, SGT — pick one story

Authentication succeeded. Priya still cannot reach SAP. The Authorization profile assigned VLAN 30 but the dACL only allows web. Or the VLAN exists only on the core, not the access switch. This lesson is what Access-Accept actually carries.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Name VLAN, dACL, SGT, redirect as four common results.
Stay under dACL scale (Cisco notes ~64 ACEs as a practical limit).
Prove the result on the switch session.
Not stack VLAN + huge dACL + SGT on day one without a design.

The ticket

Live Logs: Authorization = HR_Access. Priya still blocked. Switch shows VLAN 30 and a dACL that forgot TCP 3200 for SAP. The log is “success.” The result is wrong.

Quick interview answer

Authorization profile AVPs: dynamic VLAN (Tunnel-Private-Group-ID), downloadable ACL name, SGT, or URL redirect. PDF: Access-Accept carries VLAN, dACL, SGT, or redirect. dACLs are downloaded per session — keep them short (wired guide: treat 64 ACEs as a planning limit). SGT needs TrustSec-capable devices.

Access-Accept carrying VLAN dACL SGT or redirect — Success in Live Logs only means a profile hit. Read the AVPs.

Lab data · dummy only

PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.

Four results

Result	Good for	Needs
VLAN	Simple segmentation	VLAN exists on the access switch
dACL	Same VLAN, different rights	IP device tracking, RADIUS authz
SGT	Group-based across the campus	TrustSec / SGT exchange
Redirect	CWA / posture / BYOD	Redirect ACL + CoA

https://ise-pan.techclick-lab.in/admin

Training mock · not live

ISE Admin

Context VisibilityOperationsPolicyAdministration

Policy → Policy Elements → Results → Authorization Profiles

HR_Access

DACL

dACL_HR : permit tcp any 10.20.30.41 eq 443 3200

VLAN

30 (optional)

SGT

HR (optional, off in this lab)

Track

Log

Authorization Profiles. Training mock.

When each

Lab default: dACL in one data VLAN so printers and users can share L2 without sharing SAP. Use VLAN when the L3 design already has HR/Guest SVIs. Add SGT later, do not start with all four.

How you attach it

Side A — dACL object
Policy Elements → Downloadable ACLs. Named dACL_HR. No implicit “I meant SAP.”
Side B — profile + rule
Authorization Profile HR_Access. Authz rule: IF AD:ExternalGroups CONTAINS HR THEN HR_Access.
Side C — switch
show authentication sessions … details must list the ACL. show ip access-lists interface / session ACL.

dummy

show authentication sessions interface Gi1/0/12 details
# ACS ACL  xACSACLx-IP-dACL_HR-…
# VLAN     30

# If SAP fails: the dACL line for 10.20.30.41:3200 is missing — not “ISE is down.”

Four result failures

1 · VLAN not created on the access switch

Port errors or fallback VLAN. Create VLAN 30 everywhere it is used.

2 · dACL download fail

No IPDT / authorization. Session Auth OK, no ACL name.

3 · Too many ACEs

Switch rejects the download. Split or shorten (plan around 64).

4 · SGT on a non-TrustSec hop

Tag never enforced. You thought you segmented.

How to prove it

Close the ticket only when

1) Live Logs result name is HR_Access. 2) Switch shows the same VLAN/dACL. 3) SAP port 3200 works; guest still cannot. 4) You did not add permit ip any any to “just test.”

Traps

Log says success	Still check
Authz HR_Access	Actual ACE list
VLAN 30	Does Gi1/0/12 have VLAN 30?
SGT HR	Does the next hop understand SGT?

Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview

Sources

Lab PDF — Access-Accept AVPs: VLAN, dACL, SGT, redirect.
Cisco ISE Secure Wired Access — dACL ACE planning limit.