Authorization profile not changed after posture compliant

Antonio Macia — Wed, 19 Feb 2020 12:15:30 GMT

Hi,

We've noticed a weird behavior in our ISE deployment integrated with ASA for AnyConnect authorization.

AnyConnect users have posture configured so every time they connect they match first the "posture unknown" authorization profile while AnyConnect runs the system scan. We observe this normal behavior in the Radius live logs.

Once the client is compliant, the status changes to "Compliant" in the "Posture Status" column, BUT the "authorization profile" column is not updated with the valid rule that matches the compliant status. However, the dACL sent to ASA and actually applied is the correct one based on the user profile.

ISE performs just authorization, not authentication which is validated by the ASA using certificates.

Summarizing: ISE sees the user as compliant, internally matches the authorization profile for a compliant user, but the Radius logs are not updated accordingly and we see all the users with the status "unknown".

Any ideas?

Thanks.

Re: Authorization profile not changed after posture compliant

Greg Gibbs — Wed, 19 Feb 2020 20:51:38 GMT

The behaviour you're seeing could be related to this bug:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf59076

Re: Authorization profile not changed after posture compliant

momo2017 — Thu, 20 Feb 2020 07:30:21 GMT

Thanks.

The bug description completely matches my scenario indeed. Time to patch!

topic Authorization profile not changed after posture compliant in Network Access Control

Authorization profile not changed after posture compliant

Re: Authorization profile not changed after posture compliant

Re: Authorization profile not changed after posture compliant