ISE dacl differnet than what switch is applying

[Chris S]

Deploying ISE and trying to finalize some restrictions.  It seems the DACL defined in ISE is not what the switch is applying to the port. Any ideas why the switch is changing the deny statements? 

• ISE 3.1 (patch
• C1000-8FP-E-2G-L

Here is what we have defined in ISE:

Here is what the switch is applying:

[Rob Ingram · Accepted solution]

@Chris S use the wildcard not the subnet mask when configuring the DACL.

Also you can use Check DACL Syntax to confirm the syntax is correct.

[Chris S]

That was it - the syntax was valid against the ISE checker with a standard subnet.