policyset.yaml

- name: Create ISE Policy Elements and Policy Sets
  hosts: ise_servers
  vars_files:
    - credentials.yaml
    - variables.yaml
  vars:
    ise_login: &ise_login
      ise_hostname: "{{ ise_hostname }}"
      ise_username: "{{ ise_username }}"
      ise_password: "{{ ise_password }}"
      ise_verify: "{{ ise_verify }}"
      ise_debug: false
  gather_facts: no

  tasks:

#
# Create Network Device Groups for MM & LIM
#

  - name: Create NDG Root Group - Deployment Stage
    cisco.ise.network_device_group:
      <<: *ise_login 
      state: present
      description: "Root Deployment Stage NDG"
      name: "Deployment Stage#Deployment Stage"
      othername: "Deployment Stage"

  - name: Create NDG Group - Monitor Mode
    cisco.ise.network_device_group:
      <<: *ise_login 
      state: present
      description: "Monitor Mode NDG"
      name: "Deployment Stage#Deployment Stage#Monitor Mode" 
      othername: "Deployment Stage"

  - name: Create NDG Group - Low Impact Mode
    cisco.ise.network_device_group:
      <<: *ise_login 
      state: present
      description: "Low Impact Mode NDG"
      name: "Deployment Stage#Deployment Stage#Low Impact Mode" 
      othername: "Deployment Stage"

#
# Create the Active Directory Join Point
#
  - name: Create AD Join Point
    cisco.ise.active_directory:
      <<: *ise_login 
      state: present
      name: "{{ ise_global.ad_join_point_name }}"
      domain: "{{ ise_global.ad_domain_name }}"
    register: ad_id

#
# Join all ISE nodes to the domain using domain credentials
# This example uses 'ad_username' and 'ad_password' stored in ansible-vault and pulled from the 'vault.yaml' vars_file
#

  - name: Join the domain
    cisco.ise.active_directory_join_domain_with_all_nodes:
      <<: *ise_login
      additionalData:
      - name: username
        value: "{{ ad_username }}"
      - name: password
        value: "{{ ad_password }}"
      - name: orgunit
        value: "{{ ise_global.ad_orgunit }}"
      id: "{{ ad_id.ise_response.id }}"

#
# Retrieve the SID values for AD Groups and add the groups
#
  - name: Get Domain Computers Group SID
    cisco.ise.active_directory_groups_by_domain_info:
      <<: *ise_login
      id: "{{ ad_id.ise_response.id }}"
      additionalData:
      - name: domain
        value: "{{ ise_global.ad_domain_name }}"
      - name: filter
        value: "Domain Computers"
    register: domain_computers_sid

  - name: Get Domain Users Group SID
    cisco.ise.active_directory_groups_by_domain_info:
      <<: *ise_login
      id: "{{ ad_id.ise_response.id }}"
      additionalData:
      - name: domain
        value: "{{ ise_global.ad_domain_name }}"
      - name: filter
        value: "Domain Users"
    register: domain_users_sid

  - name: Add Groups
    cisco.ise.active_directory_add_groups:
      <<: *ise_login
      id: "{{ ad_id.ise_response.id }}"
      name: "{{ ise_global.ad_join_point_name }}"
      domain: "{{ ise_global.ad_domain_name }}"
      adgroups:
        groups:
        - name: "{{ ise_global.ad_domain_name }}/Users/Domain Computers"
          sid: "{{ domain_computers_sid.ise_response.groups[0].sid }}"
        - name: "{{ ise_global.ad_domain_name }}/Users/Domain Users"
          sid: "{{ domain_users_sid.ise_response.groups[0].sid }}"

#
# Gather Default Condition IDs
#

  - name: Get Network Conditions
    cisco.ise.network_access_conditions_for_authentication_rule_info:
      <<: *ise_login 
    register: conditions

  - name: Get Wired_802.1X Condition ID
    cisco.ise.network_access_conditions_info:
      <<: *ise_login
      name: "Wired_802.1X"
    register: wired802_1x_condition_id

  - name: Get Wired_MAB Condition ID
    cisco.ise.network_access_conditions_info:
      <<: *ise_login
      name: "Wired_MAB"
    register: wiredMAB_condition_id

  - name: Get Wireless_Access Condition ID
    cisco.ise.network_access_conditions_info:
      <<: *ise_login
      name: "Wireless_Access"
    register: wirelessAccess_condition_id

  - name: Get Wireless_802.1X Condition ID
    cisco.ise.network_access_conditions_info:
      <<: *ise_login
      name: "Wireless_802.1X"
    register: wireless802_1x_condition_id

#
# Create Policy Elements to be used in Policy Sets
# Allowed Protocols, Cert Auth Profile, Identity Source Sequence
#

  - name: Create Allowed Protocols - MAB_Dot1x
    cisco.ise.allowed_protocols:
      <<: *ise_login 
      state: present
      name: "MAB_Dot1x"
      processHostLookup: true
      allowPapAscii: false
      allowChap: false
      allowMsChapV1: false
      allowMsChapV2: false
      allowEapMd5: false
      allowEapFast: false
      allowEapTls: true
      allowEapTtls: false
      allowLeap: false
      allowPeap: true
      allowPreferredEapProtocol: false
      allowTeap: true
      allowWeakCiphersForEap: false
      eapTlsLBit: false
      requireMessageAuth: false
      description: ""
      eapTls:
        allowEapTlsAuthOfExpiredCerts: false
        eapTlsEnableStatelessSessionResume: true
        eapTlsSessionTicketPrecentage: 90
        eapTlsSessionTicketTtl: 2
        eapTlsSessionTicketTtlUnits: "HOURS"
      peap:
        allowPeapEapGtc: false
        allowPeapEapMsChapV2: true
        allowPeapEapMsChapV2PwdChange: true
        allowPeapEapMsChapV2PwdChangeRetries: 3
        allowPeapEapTls: false
        allowPeapV0: false
        requireCryptobinding: false
      teap:
        requestBasicPwdAuth : false
        acceptClientCertDuringTunnelEst: true
        allowDowngradeMsk: true
        allowTeapEapMsChapV2: true
        allowTeapEapMsChapV2PwdChange: true
        allowTeapEapMsChapV2PwdChangeRetries: 3
        allowTeapEapTls: true
        allowTeapEapTlsAuthOfExpiredCerts: true
        enableEapChaining: true

  - name: Create Allowed Protocols - Dot1x
    cisco.ise.allowed_protocols:
      <<: *ise_login 
      state: present
      name: "Dot1x"
      processHostLookup: true
      allowPapAscii: false
      allowChap: false
      allowMsChapV1: false
      allowMsChapV2: false
      allowEapMd5: false
      allowEapFast: false
      allowEapTls: true
      allowEapTtls: false
      allowLeap: false
      allowPeap: true
      allowPreferredEapProtocol: false
      allowTeap: true
      allowWeakCiphersForEap: false
      eapTlsLBit: false
      requireMessageAuth: false
      description: ""
      eapTls:
        allowEapTlsAuthOfExpiredCerts: false
        eapTlsEnableStatelessSessionResume: true
        eapTlsSessionTicketPrecentage: 90
        eapTlsSessionTicketTtl: 2
        eapTlsSessionTicketTtlUnits: "HOURS"
      peap:
        allowPeapEapGtc: false
        allowPeapEapMsChapV2: true
        allowPeapEapMsChapV2PwdChange: true
        allowPeapEapMsChapV2PwdChangeRetries: 3
        allowPeapEapTls: false
        allowPeapV0: false
        requireCryptobinding: false
      teap:
        requestBasicPwdAuth : false
        acceptClientCertDuringTunnelEst: true
        allowDowngradeMsk: true
        allowTeapEapMsChapV2: true
        allowTeapEapMsChapV2PwdChange: true
        allowTeapEapMsChapV2PwdChangeRetries: 3
        allowTeapEapTls: true
        allowTeapEapTlsAuthOfExpiredCerts: true
        enableEapChaining: true

  - name: Create Cert Auth Profile for cert-based authC
    cisco.ise.certificate_profile:
      <<: *ise_login
      state: present
      name: "{{ ise_global.cap_name_1 }}"
      description: ""
      externalIdentityStoreName: "{{ ise_global.ad_join_point_name }}"
      usernameFrom: "CERTIFICATE"
      certificateAttributeName: "SUBJECT_COMMON_NAME"
      matchMode: "RESOLVE_IDENTITY_AMBIGUITY"
      allowedAsUserName: false

  - name: Create ISS for EAP-TLS
    cisco.ise.id_store_sequence:
      <<: *ise_login 
      state: present
      name: "{{ ise_global.iss_name_1 }}"
      description: ""
      certificateAuthenticationProfile: "{{ ise_global.cap_name_1 }}"
      idSeqItem:
      - idstore: "{{ ise_global.ad_join_point_name }}"
        order: 0
      breakOnStoreFail: true


#
# Create DACLs and AuthZ Profiles
#

  - name: Create DACL - MM-DACL-AD-Computer
    cisco.ise.downloadable_acl:
      <<: *ise_login 
      state: present
      dacl: "permit ip any any"
      description: ""
      daclType: "IPV4"
      name: MM-DACL-AD-Computer

  - name: Create DACL - MM-DACL-AD-User
    cisco.ise.downloadable_acl:
      <<: *ise_login 
      state: present
      dacl: "permit ip any any"
      description: ""
      daclType: "IPV4"
      name: MM-DACL-AD-User

  - name: Create DACL - MM-DACL-Default
    cisco.ise.downloadable_acl:
      <<: *ise_login 
      state: present
      dacl: "permit ip any any"
      description: ""
      daclType: "IPV4"
      name: MM-DACL-Default

  - name: Create DACL - LIM-DACL-AD-Computer
    cisco.ise.downloadable_acl:
      <<: *ise_login 
      state: present
      dacl: "permit ip any any"
      description: ""
      daclType: "IPV4"
      name: LIM-DACL-AD-Computer

  - name: Create DACL - LIM-DACL-AD-User
    cisco.ise.downloadable_acl:
      <<: *ise_login 
      state: present
      dacl: "permit ip any any"
      description: ""
      daclType: "IPV4"
      name: LIM-DACL-AD-User

  - name: Create DACL - LIM-DACL-Default
    cisco.ise.downloadable_acl:
      <<: *ise_login 
      state: present
      dacl: "permit udp any eq bootpc any eq bootps\npermit udp any any eq domain\npermit udp any any eq tftp\ndeny ip any any"
      description: ""
      daclType: "IPV4"
      name: LIM-DACL-Default

  - name: Create AuthZ Profile - MM-AuthZ-AD-Computer
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      daclName: "MM-DACL-AD-Computer"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "MM-AuthZ-AD-Computer"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

  - name: Create AuthZ Profile - MM-AuthZ-AD-User
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      daclName: "MM-DACL-AD-User"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "MM-AuthZ-AD-User"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

  - name: Create AuthZ Profile - MM-AuthZ-Default
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      daclName: "MM-DACL-Default"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "MM-AuthZ-Default"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

  - name: Create AuthZ Profile - LIM-AuthZ-AD-Computer
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      daclName: "LIM-DACL-AD-Computer"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "LIM-AuthZ-AD-Computer"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

  - name: Create AuthZ Profile - LIM-AuthZ-AD-User
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      daclName: "LIM-DACL-AD-User"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "LIM-AuthZ-AD-User"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

  - name: Create AuthZ Profile - LIM-AuthZ-Default
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      daclName: "LIM-DACL-Default"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "LIM-AuthZ-Default"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

  - name: Create AuthZ Profile - AuthZ-Wireless-Computer
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "AuthZ-Wireless-Computer"
      airespaceACL: "{{ ise_global.airespace_acl_name }}"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

  - name: Create AuthZ Profile - AuthZ-Wireless-User
    cisco.ise.authorization_profile:
      <<: *ise_login 
      state: present
      accessType: "ACCESS_ACCEPT"
      description: ""
      id: ""
      authzProfileType: "SWITCH"
      name: "AuthZ-Wireless-User"
      airespaceACL: "{{ ise_global.airespace_acl_name }}"
      profileName: "Cisco"
      serviceTemplate: false
      trackMovement: false
      easywiredSessionCandidate: false
      voiceDomainPermission: false

#
# Create Policy Set - Monitor Mode
#

  - name: Create Policy Set - Wired_MM
    cisco.ise.network_access_policy_set:
      <<: *ise_login 
      state: present
      condition:
        conditionType: "ConditionAndBlock"
        isNegate: false
        children:
        - conditionType: "ConditionAttributes"
          isNegate: false
          dictionaryName: "Radius"
          attributeName: "NAS-Port-Type"
          operator: "equals"
          attributeValue: "Ethernet"
        - conditionType: "ConditionAttributes"
          isNegate: false
          dictionaryName: "DEVICE"
          attributeName: "Deployment Stage"
          operator: "equals"
          attributeValue: "Deployment Stage#Monitor Mode"
      default: false
      description: "Wired Monitor Mode"
      isProxy: false
      name: "Wired_MM"
      rank: 0
      serviceName: "MAB_Dot1x"
      state_: "enabled"
    register: policy_set_mm

  - name: Wired_MM AuthC Policy - Dot1x EAP-TLS
    cisco.ise.network_access_authentication_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_mm.ise_response.id }}"
      identitySourceName: "{{ ise_global.iss_name_1 }}"
      ifAuthFail: "REJECT"
      ifProcessFail: "DROP"
      ifUserNotFound: "REJECT"
      rule:
        rank: 0
        state: "enabled"
        name: "{{ ps1.authc_rule_name_1 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wired802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapAuthentication"
            operator: "equals"
            attributeValue: "EAP-TLS"
        default: false
    register: mm_authC_rule1

  - name: Wired_MM AuthC Policy - MAB
    cisco.ise.network_access_authentication_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_mm.ise_response.id }}"
      identitySourceName: "Internal Endpoints"
      ifAuthFail: "REJECT"
      ifProcessFail: "DROP"
      ifUserNotFound: "CONTINUE"
      rule:
        rank: 1
        state: "enabled"
        name: "{{ ps1.authc_rule_name_2 }}"
        condition:
          conditionType: "ConditionReference"
          isNegate: false
          id: "{{ wiredMAB_condition_id.ise_response.id }}"
        default: false

  - name: Wired_MM AuthZ Policy 1 - AD User and Computer
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_mm.ise_response.id }}"
      rule:
        default: false
        rank: 0
        state: "enabled"
        name: "{{ ps1.authz_rule_name_1 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapTunnel"
            operator: "equals"
            attributeValue: "TEAP"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Users"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapChainingResult"
            operator: "equals"
            attributeValue: "User and machine both succeeded"
      profile:
      - "MM-AuthZ-AD-User"
      securityGroup: "Employees"

  - name: Wired_MM AuthZ Policy 2 - AD Users
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_mm.ise_response.id }}"
      rule:
        default: false
        rank: 1
        state: "enabled"
        name: "{{ ps1.authz_rule_name_2 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wired802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Users"
      profile:
      - "MM-AuthZ-AD-User"
      securityGroup: "Employees"

  - name: Wired_MM AuthZ Policy 3 - AD Computers
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_mm.ise_response.id }}"
      rule:
        default: false
        rank: 2
        state: "enabled"
        name: "{{ ps1.authz_rule_name_3 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wired802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Computers"
      profile:
      - "MM-AuthZ-AD-Computer"
      securityGroup: "Employees"

  - name: Update Wired_MM Default AuthZ Policy
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login 
      state: present
      profile:
      - "MM-AuthZ-Default"
      policyId: "{{ policy_set_mm.ise_response.id }}"
      rule:
        default: true
        name: "Default"
        rank: 3

#
# Create Policy Set - Low Impact Mode
#

  - name: Create Policy Set - Wired_LIM
    cisco.ise.network_access_policy_set:
      <<: *ise_login 
      state: present
      condition:
        conditionType: "ConditionAndBlock"
        isNegate: false
        children:
        - conditionType: "ConditionAttributes"
          isNegate: false
          dictionaryName: "Radius"
          attributeName: "NAS-Port-Type"
          operator: "equals"
          attributeValue: "Ethernet"
        - conditionType: "ConditionAttributes"
          isNegate: false
          dictionaryName: "DEVICE"
          attributeName: "Deployment Stage"
          operator: "equals"
          attributeValue: "Deployment Stage#Low Impact Mode"
      default: false
      description: "Wired Low Impact Mode"
      isProxy: false
      name: "Wired_LIM"
      rank: 1
      serviceName: "MAB_Dot1x"
      state_: "enabled"
    register: policy_set_lim

  - name: Wired_LIM AuthC Policy - Dot1x EAP-TLS
    cisco.ise.network_access_authentication_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_lim.ise_response.id }}"
      identitySourceName: "{{ ise_global.iss_name_1 }}"
      ifAuthFail: "REJECT"
      ifProcessFail: "DROP"
      ifUserNotFound: "REJECT"
      rule:
        rank: 0
        state: "enabled"
        name: "{{ ps2.authc_rule_name_1 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wired802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapAuthentication"
            operator: "equals"
            attributeValue: "EAP-TLS"
        default: false

  - name: Wired_LIM AuthC Policy - MAB
    cisco.ise.network_access_authentication_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_lim.ise_response.id }}"
      identitySourceName: "Internal Endpoints"
      ifAuthFail: "REJECT"
      ifProcessFail: "DROP"
      ifUserNotFound: "CONTINUE"
      rule:
        rank: 1
        state: "enabled"
        name: "{{ ps2.authc_rule_name_2 }}"
        condition:
          conditionType: "ConditionReference"
          isNegate: false
          id: "{{ wiredMAB_condition_id.ise_response.id }}"
        default: false

  - name: Wired_LIM AuthZ Policy 1 - AD User and Computer
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_lim.ise_response.id }}"
      rule:
        default: false
        rank: 0
        state: "enabled"
        name: "{{ ps2.authz_rule_name_1 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapTunnel"
            operator: "equals"
            attributeValue: "TEAP"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Users"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapChainingResult"
            operator: "equals"
            attributeValue: "User and machine both succeeded"
      profile:
      - "LIM-AuthZ-AD-User"
      securityGroup: "Employees"

  - name: Wired_LIM AuthZ Policy 2 - AD Users
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_lim.ise_response.id }}"
      rule:
        default: false
        rank: 1
        state: "enabled"
        name: "{{ ps2.authz_rule_name_2 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wired802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Users"
      profile:
      - "LIM-AuthZ-AD-User"
      securityGroup: "Employees"

  - name: Wired_LIM AuthZ Policy 3 - AD Computers
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_lim.ise_response.id }}"
      rule:
        default: false
        rank: 2
        state: "enabled"
        name: "{{ ps2.authz_rule_name_3 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wired802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Computers"
      profile:
      - "LIM-AuthZ-AD-Computer"
      securityGroup: "Employees"

  - name: Update LIM Default AuthZ Policy
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login 
      state: present
      profile:
      - "LIM-AuthZ-Default"
      policyId: "{{ policy_set_lim.ise_response.id }}"
      rule:
        default: true
        name: "Default"
        rank: 3

#
# Create Policy Set - Wireless Secure
#

  - name: Create Policy Set - Wireless Secure
    cisco.ise.network_access_policy_set:
      <<: *ise_login 
      state: present
      condition:
        conditionType: "ConditionAndBlock"
        isNegate: false
        children:
        - conditionType: "ConditionReference"
          isNegate: false
          id: "{{ wirelessAccess_condition_id.ise_response.id }}"
        - conditionType: "ConditionAttributes"
          isNegate: false
          dictionaryName: "Radius"
          attributeName: "Called-Station-ID"
          operator: "endsWith"
          attributeValue: "{{ ise_global.secure_ssid_name }}"
      default: false
      description: "Wireless Secure"
      isProxy: false
      name: "Wireless Secure"
      rank: 2
      serviceName: "Dot1x"
      state_: "enabled"
    register: policy_set_wireless_secure

  - name: Wireless Secure AuthC Policy - EAP-TLS
    cisco.ise.network_access_authentication_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_wireless_secure.ise_response.id }}"
      identitySourceName: "{{ ise_global.iss_name_1 }}"
      ifAuthFail: "REJECT"
      ifProcessFail: "DROP"
      ifUserNotFound: "REJECT"
      rule:
        rank: 0
        state: "enabled"
        name: "{{ ps3.authc_rule_name_1 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wireless802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapAuthentication"
            operator: "equals"
            attributeValue: "EAP-TLS"
        default: false

  - name: Wireless Secure AuthZ Policy 1 - AD User and Computer
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_wireless_secure.ise_response.id }}"
      rule:
        default: false
        rank: 0
        state: "enabled"
        name: "{{ ps3.authz_rule_name_1 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wireless802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapTunnel"
            operator: "equals"
            attributeValue: "TEAP"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Users"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "Network Access"
            attributeName: "EapChainingResult"
            operator: "equals"
            attributeValue: "User and machine both succeeded"
      profile:
      - "AuthZ-Wireless-User"
      securityGroup: "Employees"

  - name: Wireless Secure AuthZ Policy 2 - AD Users
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_wireless_secure.ise_response.id }}"
      rule:
        default: false
        rank: 1
        state: "enabled"
        name: "{{ ps3.authz_rule_name_2 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wireless802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Users"
      profile:
      - "AuthZ-Wireless-User"
      securityGroup: "Employees"

  - name: Wireless Secure AuthZ Policy 3 - AD Computers
    cisco.ise.network_access_authorization_rules:
      <<: *ise_login
      state: present
      policyId: "{{ policy_set_wireless_secure.ise_response.id }}"
      rule:
        default: false
        rank: 2
        state: "enabled"
        name: "{{ ps3.authz_rule_name_3 }}"
        condition:
          conditionType: "ConditionAndBlock"
          isNegate: false
          children:
          - conditionType: "ConditionReference"
            isNegate: false
            id: "{{ wireless802_1x_condition_id.ise_response.id }}"
          - conditionType: "ConditionAttributes"
            isNegate: false
            dictionaryName: "{{ ise_global.ad_join_point_name }}"
            attributeName: "ExternalGroups"
            operator: "equals"
            attributeValue: "{{ ise_global.ad_domain_name }}/Users/Domain Computers"
      profile:
      - "AuthZ-Wireless-Computer"
      securityGroup: "Employees"