topic Re: Upgrade from Cisco NAC Agent to AnyConnect in Network Access Control

Upgrade from Cisco NAC Agent to AnyConnect

dgaikwad — Wed, 28 Aug 2019 07:21:52 GMT

Hi Experts,

While upgrading and replacing, hit a bottle-neck, we were not able to identify the endpoints that are installed with AnyConnect and the ones that are still having Cisco NAC agent.
So, that this identification could be used in policies.
Was able to locate an attribute named, PostureAgentVersion, but when I check the policies, I am not able to search or locate it.

Firstly, could this attribute, PostureAgentVersion, used in policies?
Secondly is there any way that could be utilized to do this segregation?

Re: Upgrade from Cisco NAC Agent to AnyConnect

Brian Taylor — Wed, 04 Sep 2019 16:29:31 GMT

You could use nac agent to check for aciseposture.exe service check. If true, you could move that user to AD group for AC CPP.

Re: Upgrade from Cisco NAC Agent to AnyConnect

kthiruve — Wed, 04 Sep 2019 21:24:09 GMT

Service check is your option as mentioned before. You can try application check as well.

What version of ISE, NAC agent and Anyconnect are you using.

Till ISE 2.2, ISE is compatible with certain versions of NAC agent.

Check the ISE compatibility guide.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/compatibility/ise_sdt.html#pgfId-123696

Anyconnect also support UID and ACIDEX attributes. UID is a unique identifier that identifies Anyconnect. Mainly used to identify corporate laptops. ISE 2.6 and AC 4.7 are compatible and validated for this.

Thanks

Krishnan