https://community.cisco.com/t5/network-access-control/posture-during-psn-failover/m-p/3887293#M471618 <P>PSN's are load balanced behind an F5.&nbsp; When a PSN failover occur's the new PSN initiates new authentication session and a new redirect ACL is sent to the switch.&nbsp; However, the endpoint posture module never initiates new posture assessment.&nbsp; The endpoint still shows it self as compliant, but redirect ACL on the switch blocks traffic.<BR /><BR />How do you get the posture reassess the endpoint in this scenario?</P> Tue, 09 Jul 2019 20:38:28 GMT davguti2@cisco.com 2019-07-09T20:38:28Z https://community.cisco.com/t5/network-access-control/posture-during-psn-failover/m-p/3887293#M471618 <P>PSN's are load balanced behind an F5.&nbsp; When a PSN failover occur's the new PSN initiates new authentication session and a new redirect ACL is sent to the switch.&nbsp; However, the endpoint posture module never initiates new posture assessment.&nbsp; The endpoint still shows it self as compliant, but redirect ACL on the switch blocks traffic.<BR /><BR />How do you get the posture reassess the endpoint in this scenario?</P> Tue, 09 Jul 2019 20:38:28 GMT https://community.cisco.com/t5/network-access-control/posture-during-psn-failover/m-p/3887293#M471618 davguti2@cisco.com 2019-07-09T20:38:28Z https://community.cisco.com/t5/network-access-control/posture-during-psn-failover/m-p/3888879#M471619 <P>Make sure all PSNs in LB cluster are part of some node group. There is a designated "master" that will initiate CoA in event that another PSN in node group had a session in URL-redirect pending state. This should ensure that new session established using new redirect ACL appropriate to current PSN. &nbsp;</P> Fri, 12 Jul 2019 02:57:41 GMT https://community.cisco.com/t5/network-access-control/posture-during-psn-failover/m-p/3888879#M471619 chyps 2019-07-12T02:57:41Z