topic Re: ISE Posture based on OS version in Network Access Control

ISE Posture based on OS version

misinsuan2229 — Tue, 20 Nov 2018 14:48:07 GMT

Hi Cisco Community,

Is there anyway I can include posture to check OS version on Windows or MAC. Policy will be to check if the Windows is 7 or 10 for compliance and other version will be non-compliant?

We are doing ISE Posture POC in our company and one requirement is having to check Windows OS version, allow only Windows 7&10.

Re: ISE Posture based on OS version

Timothy Abbott — Tue, 20 Nov 2018 14:55:35 GMT

Have you tried using a simple dictionary condition? There is an attribute for "Endpoints:OperatingSystem" that will allow you to specifiy the OS version you want to check for.

Regards,

-Tim

Re: ISE Posture based on OS version

misinsuan2229 — Mon, 26 Nov 2018 05:20:34 GMT

Hi Timothy,

the dictionary condition on Policy can only check Windows or Mac, etc, but not really on the OS version like Windows 10 vs Windows 7, is there anyway with it? Maybe I am missing something.

Re: ISE Posture based on OS version

Nidhi — Mon, 26 Nov 2018 06:14:50 GMT

You can create a condition to check the registry entry under - HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion

Check the CurrentVersion filed or the ProductName field.

Thanks,

Nidhi

Re: ISE Posture based on OS version

manvik — Tue, 22 Dec 2020 05:47:05 GMT

Thanks,

I was wondering what should be given in the value field.

ISE does not accept spaces

Re: ISE Posture based on OS version

Nadav — Tue, 22 Dec 2020 17:25:26 GMT

That's the condition's name, not the attribute. You can call it: Windows_7_Check.

Look at the limitations in the textbox you provided.

Re: ISE Posture based on OS version

AshwinChougule11 — Mon, 14 Jun 2021 12:47:35 GMT

Hello,

I have tried this simple dictionary condition but I am unable to call this condition into the requirements. I have not able to see that option into condition part

Re: ISE Posture based on OS version

Marcelo Morais — Mon, 14 Jun 2021 13:23:45 GMT

Hi @AshwinChougule11 ,

please take a look at the following post: Enforcing OS version using ISE.

Hope this helps !!!