topic Re: AnyConnect Posture Module between Client and Stealth Mode in Network Access Control

AnyConnect Posture Module between Client and Stealth Mode

edmcnich — Mon, 13 Aug 2018 18:59:08 GMT

Customer is running AnyConnect and Posture Module on Windows endpoints. When connected to VPN, customer would like the posture module to show up and show status. When connected to LAN and WLAN, customer would like Stealth Mode. We got this to work by configuring different Client Provisioning Policies under Posture for each connection. So when an end user connects and authenticates via VPN on the ASA, the Posture Module runs and is visible, but when connecting to LAN or WLAN, the Posture Module disappears and runs in Stealth Mode. One issue when bouncing back between LAN/WLAN and VPN is that it take 30 seconds or so for the Posture Module to appear and scan the device after VPN connection and Authentication. Is there a way to have the module run quicker?

Re: AnyConnect Posture Module between Client and Stealth Mode

RichardAtkin — Mon, 13 Aug 2018 20:44:20 GMT

You need the Posture Module to send it’s Discovery requests more quickly, but I’m not sure there is an easy way to do this, though I have similar frustrations so it’d be good if someone knew a way!

Re: AnyConnect Posture Module between Client and Stealth Mode

paul — Mon, 13 Aug 2018 22:14:44 GMT

What trick are you using for posture discovery when on VPN? Are you redirecting one of the know calls like enroll.cisco.com? Or using a posture discovery host?

Re: AnyConnect Posture Module between Client and Stealth Mode

edmcnich — Wed, 15 Aug 2018 20:42:29 GMT

Basically in the client provisioning policy we created a condition for Windows devices that if authentication from VPN_Group (which is the ASAs doing RAVPN), Results will be posture module. For all other NAS devices (WLC, Switches), results will be AnyConnect Stealth. Only issue is that when we switch from wireless to VPN, it takes about 30-40 seconds for the posture module to enable.

Re: AnyConnect Posture Module between Client and Stealth Mode

hslai — Sun, 02 Sep 2018 02:06:38 GMT

I found it best to also define the ISE Posture profile in ASA; e.g.

# show running-config webvpn
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-4.6.01103-webdeploy-k9.pkg 1 regex "Windows NT"
anyconnect image disk0:/anyconnect-linux64-4.6.01103-webdeploy-k9.pkg 2 regex "Linux"
anyconnect image disk0:/anyconnect-macos-4.6.01103-webdeploy-k9.pkg 3 regex "Intel Mac OS X"
anyconnect profiles ISEPosture1 disk0:/ISEPostureCFG.xml
anyconnect profiles ise-vpn-lab disk0:/ise-vpn-lab.xml
anyconnect enable
cache
disable
error-recovery disable