topic ISE 2.2 Posture Bypass in Network Access Control

ISE 2.2 Posture Bypass

Andy Guley — Tue, 23 Apr 2019 20:10:00 GMT

My ISE environment is doing posture. One of the posture requirements is that the computer must be on the domain. We are checking for a certain registry entry to confirm that the machines are on the domain.

I have a use case where we have a handful of laptops that are not on our domain but we want them to be able to use the corporate network just like any other user. Is there a way I can put a bypass in based on MAC address so these laptops don't have to be on the domain?

Thanks

Re: ISE 2.2 Posture Bypass

Mike.Cifelli — Wed, 24 Apr 2019 12:14:31 GMT

There are several ways you can approach this. One way you can accomplish this is by setting up your Client Provisioning Policy 'other conditions' to match on an external source (AD) or internal endpoint groups. This would force posture assessment on your known assets and other assets would bypass the policy therefore not need to be scanned. HTH!

Re: ISE 2.2 Posture Bypass

Nidhi — Wed, 24 Apr 2019 15:34:18 GMT

I suggest you refer the prescriptive deployment guide here - Posture Prescriptive Deployment Guide

Thanks,

Nidhi