topic Re: ISE posture: checking os patch for MacOS and windows in Network Access Control

ISE posture: checking os patch for MacOS and windows

Sean Yuan — Mon, 10 Jun 2019 03:22:01 GMT

Hi experts:

My customer wants to check the OS patch for MacOS and windows via anyconnect posture module.

I think posture cannot check the OS patch derictly, posture module need to active the sccm agent or os patch mangement agent for checking OS patch, and ISE just check whether the agent was updated, enabled or installed.

And the remediation for OS patch also need to active os patch agent to remediate.

I'm not sure it's correct or not, For OS patch checking, if have BP, kindly post it.

Thanks a lot for reply.

Best Regards

Re: ISE posture: checking os patch for MacOS and windows

Marvin Rhoads — Mon, 10 Jun 2019 06:27:23 GMT

There are several ISE posture resources linked here:

https://community.cisco.com/t5/security-documents/ise-posture/ta-p/3657443

We can check both OS types for patch version although the capabilities vary between Windows and Mac OS as well as for whether you are using the temporal Agent of AnyConnect. Details are in the "ISE Posture Prescriptive Deployment Guide" which is among the resources linked above.

Re: ISE posture: checking os patch for MacOS and windows

Sean Yuan — Mon, 10 Jun 2019 08:20:43 GMT

Thanks a lot for your help.

Have a nice day sir.