# Authorization result: VLAN, dACL, SGT — pick one story Source: https://ai.techclick.in/blog_cisco_ise_authorization_dacl_vlan Markdown: https://ai.techclick.in/blog_cisco_ise_authorization_dacl_vlan.md Publisher: Techclick Infosec Pvt Ltd Access-Accept can carry VLAN, downloadable ACL, SGT, or redirect. Choose per ticket. Dummy HR dACL. ## The ticket Live Logs: Authorization = HR_Access. Priya still blocked. Switch shows VLAN 30 and a dACL that forgot TCP 3200 for SAP. The log is “success.” The result is wrong. Quick interview answer Authorization profile AVPs: dynamic VLAN (Tunnel-Private-Group-ID), downloadable ACL name, SGT, or URL redirect. PDF: Access-Accept carries VLAN, dACL, SGT, or redirect. dACLs are downloaded per session — keep them short (wired guide: treat 64 ACEs as a planning limit). SGT needs TrustSec-capable devices. Hero · four stamps Success in Live Logs only means a profile hit. Read the AVPs. Lab data · dummy only PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60 . Not a live customer. ## Four results Result Good for Needs VLAN Simple segmentation VLAN exists on the access switch dACL Same VLAN, different rights IP device tracking, RADIUS authz SGT Group-based across the campus TrustSec / SGT exchange Redirect CWA / posture / BYOD Redirect ACL + CoA https://ise-pan.techclick-lab.in/admin Training mock · not live ISE Admin Context Visibility Operations Policy Administration Policy → Policy Elements → Results → Authorization Profiles ### HR_Access DACL dACL_HR : permit tcp any 10.20.30.41 eq 443 3200 VLAN 30 (optional) SGT HR (optional, off in this lab) Track Log Cancel Save Authorization Profiles. Training mock. ## When each Lab default: dACL in one data VLAN so printers and users can share L2 without sharing SAP. Use VLAN when the L3 design already has HR/Guest SVIs. Add SGT later, do not start with all four. ## How you attach it - #### Side A — dACL object Policy Elements → Downloadable ACLs. Named dACL_HR. No implicit “I meant SAP.” - #### Side B — profile + rule Authorization Profile HR_Access. Authz rule: IF AD:ExternalGroups CONTAINS HR THEN HR_Access. - #### Side C — switch show authentication sessions … details must list the ACL. show ip access-lists interface / session ACL. dummy show authentication sessions interface Gi1/0/12 details # ACS ACL xACSACLx-IP-dACL_HR-… # VLAN 30 # If SAP fails: the dACL line for 10.20.30.41:3200 is missing — not “ISE is down.” ## Four result failures ### 1 · VLAN not created on the access switch Port errors or fallback VLAN. Create VLAN 30 everywhere it is used. ### 2 · dACL download fail No IPDT / authorization. Session Auth OK, no ACL name. ### 3 · Too many ACEs Switch rejects the download. Split or shorten (plan around 64). ### 4 · SGT on a non-TrustSec hop Tag never enforced. You thought you segmented. ## How to prove it Close the ticket only when 1) Live Logs result name is HR_Access. 2) Switch shows the same VLAN/dACL. 3) SAP port 3200 works; guest still cannot. 4) You did not add permit ip any any to “just test.” ## Traps Log says success Still check Authz HR_Access Actual ACE list VLAN 30 Does Gi1/0/12 have VLAN 30? SGT HR Does the next hop understand SGT? ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 dACL is… An ACL ISE downloads onto the NAD for that session A PAN persona A guest password An NTP key Correct: a . Concept. Q2 Practical dACL size to plan around? About 64 ACEs on many Cisco NADs Unlimited always Exactly 2 Only 1 per campus Correct: a . Wired guide note. Q3 Auth OK but no ACL name on the session. Suspect? dACL download / IPDT / authorization MnT disk Guest portal theme pxGrid version Correct: a . Failure 2. Q4 VLAN 30 in ISE, VLAN missing on the access switch. Result? Port cannot apply the intended segment Automatic VLAN create everywhere PSN becomes PAN MAB turns off Correct: a . Failure 1. Q5 SGT without TrustSec hops… May never be enforced Always filters on every cheap switch Replaces RADIUS Disables dACL forever Correct: a . Failure 4. Q6 PDF Access-Accept may carry… VLAN, dACL, SGT, or redirect Only a syslog string Only NTP Only the PAN IP Correct: a . Evidence pack. Check answers Reset Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview ## Sources - Lab PDF — Access-Accept AVPs: VLAN, dACL, SGT, redirect. - Cisco ISE Secure Wired Access — dACL ACE planning limit. Related: ISE evidence desk · session factory · Forescout series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt