topic Re: Anyconnect 4.7 bypassing, networks configured for NAC Agent in Network Access Control

Anyconnect 4.7 bypassing, networks configured for NAC Agent

raulantoniorz91 — Sun, 22 Sep 2019 14:43:34 GMT

Hi,

I'm installing ISE 2.6 with Anyconnect 4.7 with ISE Posture VPN Posture and Compliance Module 4.3 for posture. But When test PC is connected to NAD, it gets authenticated but Compliance Modue shows message "Byppassing anyconnect scan your network is configured to use Cisco NAC Agent", and ISE shows Pending Posture for this end point.

I have configured Posture conditions, policies and there will be no redirection to portal since it is a requirement from end customer, for security non-compliant users should contact IT crew to get Anyconnect instead of download from client privisioning portal because AD policies don't allow to users to install external programs.

This is the current configuration

Conditions, only to check if there is a McAfee instalation

Posture requirements

Thank you for your help.

Re: Anyconnect 4.7 bypassing, networks configured for NAC Agent

Rob Ingram — Sun, 22 Sep 2019 15:25:42 GMT

Hi, You are checking for version 3.x or earlier of the compliance module in the requirements and posture policy, however you are using version 4.3, change this to version 4.x or later.

HTH

Re: Anyconnect 4.7 bypassing, networks configured for NAC Agent

raulantoniorz91 — Sun, 22 Sep 2019 16:01:22 GMT

Hi,

Thank you for your help, I needed to move AV condition as AM condition to use it as 4.x version, since AV conditions are available only for 3.x. When applied and shut/no shut to user interface now Posture Status is "NotApplicable".