Dynamic attributes rule conditions

Dynamic attributes rule conditions allow you to specify access control rules based on real-time properties such as network objects, device types, locations, and security tags. Dynamic attributes can be used as source criteria and destination criteria in access control rules. These criteria help match traffic more flexibly and accurately.

Dynamic attributes configuration and behavior

You can use these types of dynamic attributes to match connections in DNS rules:

  • Dynamic objects (Source or destination): The dynamic attributes connector collects data such as networks and IP addresses from cloud providers for use in access control rules. For more information, refer to About the Dynamic Attributes Connector .

  • SGT objects (Source only): These contain tags defined manually or in Cisco ISE. For more information, refer to Source and destination security group tag (SGT) matching and Security group tags .

  • Location IP objects (Source only): Defined by Cisco ISE.

  • Device type objects (Source only): Defined by Cisco ISE, also referred to as endpoint profile objects.

When you configure dynamic attributes for a DNS rule, objects of the same type within a source or destination list use OR logic, while objects of different types use AND logic. For example, if you select both a security group tag, and a dynamic object that lists IP addresses, the rule matches if traffic with the tag originates from (or is destined to) one of those IP addresses.

When you open the Dynamic Attributes tab, all Dynamic Objects and Security Group Tags appear in the list. To remove objects from the list, deselect the options. To find an object, type in the search box.