topic Re: Endpoints show as posture applicable in Network Access Control

Endpoints show as posture applicable

snir_orlanczyk — Wed, 27 Feb 2019 11:30:50 GMT

when looking at the home screen of ISE the compliance % bar shows false info.

from looking into it i have found that it does that because it includes endpoints that are not supposed to go through posture process in the count. is there a way to fix it ?

Thanks 🙂

Re: Endpoints show as posture applicable

Mike.Cifelli — Wed, 27 Feb 2019 12:27:53 GMT

Are you using posture policies for some of your devices? If so, can you share?

Re: Endpoints show as posture applicable

snir_orlanczyk — Tue, 05 Mar 2019 11:45:23 GMT

Yes we use posture policy for windows devices, I've attached a screenshot of our posture policy.

Re: Endpoints show as posture applicable

Mike.Cifelli — Tue, 05 Mar 2019 17:35:50 GMT

You can tweak your posture policies to match on more specific things such as conditions OR endpoint groups. For example, some conditions that you can match on may include device type, location, external AD groups, etc. To add additional conditions that hosts must match to hit a posture policy or not hit it edit the rule you want. From here you can go to other conditions and tweak the policy to what you want. If you want to match identity groups that will be in the column next to the rule name. The main thing is figuring out how you want to separate hosts you want to hit the posture policy versus hosts that you do not want to hit the policy. IMO your easiest bet is probably by endpoint groups OR external AD security groups.
HTH!