topic Re: Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network. in Network Access Control

Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network.

mpeeters — Mon, 13 May 2019 12:09:47 GMT

Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network.

ie: via wired network adapter, or wireless usb adapter , etc.

If yes how would we configure this policy ?

Thx

Re: Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network.

howon — Mon, 13 May 2019 12:50:46 GMT

We do have feature to limit to single network interface using AnyConnect Network Access module, but this is not supported with temporal agent which is suited for guest users.

Re: Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network.

mpeeters — Mon, 13 May 2019 12:41:02 GMT

Hi Hosuk

Would you please provide a link to the document that shows how to setup the single network enforcement ? I did a search and was unable to find. Partner is requesting guidance.

Thx

Re: Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network.

Jason Kunst — Mon, 13 May 2019 12:50:25 GMT

Ise guest has no such controls since their is nothing on the device. I would suggest you limit the amount of devices a user can connect with a single credential. The default is 3-5 but can be enforced under the guest type. Otherwise there is nothing.

Like Hosuk said it’s a Anyconnect full agent capability. You’re not going to install on guest machine?

This is an Anyconnect feature nothing to do with ise , it’s corporate network enforcement

Have you tried their forum?

Re: Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network.

howon — Mon, 13 May 2019 12:50:12 GMT

I mistakenly noted that this was part of AnyConnect Posture Module. Rather this is the behavior when you install AnyConnect Network Access Module.

Re: Can ISE use the posture feature to prevent the guest laptop (win) from sharing the network to others via laptop when the guest is connected to guest network.

mpeeters — Mon, 13 May 2019 12:59:41 GMT

My ask was for the procedure to check in ise if it was part of the posture module. I also understand that the anyconnect posture module is not a guest use case deployment model... has shared that with partner. Was asking for full posture agent for reference.

Thx for the update that this control is via the NAM module.