topic ISE Posture Last state caching in Network Access Control

ISE Posture Last state caching

Sitita — Wed, 26 Sep 2018 17:12:13 GMT

How can ISE on last state of clients

My clients are installed Posture agent and I had configure authorize to be like this pic It's working fine clients can redirecting to url to download an agent to install and posture can health checking and CoA to change status

But After I had rebooted my computer, ISE wasn't remember last state of clients which are installed an agent

What should I have to do more on policy?

Re: ISE Posture Last state caching

Aravind Ravichandran — Mon, 01 Oct 2018 08:15:16 GMT

Hi,

There are 2 things to be considered here.

If you are talking about Posture lease, there is a option Administration->Systems->Settings->Posture->General settings,in which if"Perform posture assessment every time a user connects to the network" is select every time when machine reboots or it disconnect from network it will undergoes posture assessment,There is another option "Perform posture assessment every ", where you can mention days after which posture assessment will start.

Posture Lease

Perform posture assessment every time a user connects to the network

Perform posture assessment every

Days
Posture compliant cache status is available in ISE 2.4,there is a option under posture->general settings->below Posture lease

Cache Last Known Posture Compliant Status

Last Known Posture Compliant State

Hours

where you can mention last known posture compliant state in minutes/hours/days,range upto max 30days/720 hours/43200 minutes can be configured.

Re: ISE Posture Last state caching

Peter Koltl — Fri, 19 Oct 2018 08:13:43 GMT

What is the difference?

Re: ISE Posture Last state caching

Brian Taylor — Fri, 30 Nov 2018 02:26:52 GMT

I think this is what it does.

Cisco ISE provides an option to configure grace time for devices that become noncompliant. Cisco ISE caches the results of posture assessment for a configurable amount of time. If a device is found to be noncompliant, Cisco ISE looks for the previously known good state in its cache and provides grace time for the device, during which the device is granted access to the network. You can configure the grace time period in minutes, hours, or days (up to a maximum of 30 days).

Re: ISE Posture Last state caching

Jason Kunst — Fri, 30 Nov 2018 14:30:04 GMT

Are you looking at this?
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/release_notes/b_ise_24_rn.html#concept_8EF1FE067F164768BCE0F63C2BD23158
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_010111.html#task_19FF1593E194455087D9AB00FB843020

Posture Lease
Perform posture assessment every time a user connects to the network
Perform posture assessment every		Days