topic Re: ISE not pulling system domain information for MAC OSX devices during posture in Network Access Control

ISE not pulling system domain information for MAC OSX devices during posture

mparthan — Mon, 17 Sep 2018 19:04:18 GMT

Hello Team,

Would the posture module populate system domain information for OSX by default even if the condition is not set as a requirement?

I see the system domain information populated in the posture report for Windows , however it is blank when a posture report is sent for the mac device. Refraining from uploading screenshots since it contains user data.

For my Windows workstation, I have a condition defined to see if the workstation is domain joined or not,but dont have a similar condition for OSX.

How is the system domain information populated? Does the Anyconnect gather it as a base attribute or based on the conditions enforced?

Thanks for helping with this.

--Malavika

Re: ISE not pulling system domain information for MAC OSX devices during posture

howon — Wed, 19 Sep 2018 00:53:12 GMT

You can gather macOS AD domain membership using the plist files. Simple way is to find out if there is plist file (EXAMPLE as the AD domain name):

/Library/Preferences/OpenDirectory/DynamicData/Active\ Directory/EXAMPLE.plist

If you want to get more detailed information about the domain then you can also look into the plist file and compare the values within. Sample command here will allow you to view the content of plist file so you can craft matching ISE posture conditions:

sudo defaults read /Library/Preferences/OpenDirectory/DynamicData/Active\ Directory/EXAMPLE.plist

Note that it is not going to provide what is the data that is being matched, rather it will simply tell you whether your string matches with it or not. If you need to match multiple domains, you can create multiple conditions and combine them as compound conditions.

Re: ISE not pulling system domain information for MAC OSX devices during posture

mparthan — Mon, 17 Sep 2018 23:31:56 GMT

Thanks for the input, Hosuk.

So this means Anyconnect will not automatically grab this information as the customer thinks it should, correct?

What about Windows? does Anyconnect populate this domain information for Windows workstations automatically? If not, how is that information collected in the posture report.

Thanks,

Malavika

Re: ISE not pulling system domain information for MAC OSX devices during posture

howon — Mon, 17 Sep 2018 23:51:01 GMT

If customer wants to see what the value is, then no. However, if customer wants to validate whether the value is X then it is possible.

Yes, AC Posture module does this automatically for Windows. If you want to similar result for AD joined macOS, please work with the PM team.