topic Re: No Policy Server Detected in Network Access Control

No Policy Server Detected

Ali — Fri, 04 May 2018 07:27:04 GMT

Hello Community,

Running with ISE 2.1 with patch 5 and Any Connect 4.5

We are facing some issue on the random endpoints with No Policy Server Detected message in Any Connect and on ISE Live logs its showing Posture Unknown.

Endpoint are able to Ping ISE Server as well host name, also able to resolve enroll.cisco.com

Dot1x is is successfully happening for endpoint, redirection is also working, posture status is showing Pending under Live Session on ISE.

Does any thing i nee to look why Posture is not working ?

Appreciate your Inputs here.

Re: No Policy Server Detected

Craig Hyps — Sat, 05 May 2018 01:51:43 GMT

With ISE 2.1, you must rely on URL redirect for client to discover PSN, and it needs to be the PSN that authenticated client. One exception is the attempt to connect to previous PSN, but let's stick to new connection case. Therefore, you Discovery Host or resolution of enroll.cisco.com must resolve to a target beyond the redirection point and be a routeable target. If DH or enroll.cisco.com resolved to PSN, it will not work.

Re: No Policy Server Detected

hslai — Sat, 05 May 2018 08:24:41 GMT

As you mentioned this issue happening randomly, please engage Cisco TAC to troubleshoot.

Re: No Policy Server Detected

Ali — Sun, 06 May 2018 10:32:09 GMT

hslai chyps Thanks for the Input

I have taken TAC Support.

More about the issue is, when user logged on one PC posture scan is working and getting Complaint status, when the same user is logging on different PC AnyConnect after scan showing No Policy Server Detected.

After packet capture, we found that AnyConnect reaches the ISE and ISE was redirecting the AnyConnect to port 8905. When AnyConnect goes to that port ISE was sending Reset, on ISE we confirmed the port was Open. This is something weird why ISE was giving Reset.

TAC Engineer gone through support bundle and found some bugs along with high load average and suggested either Reload the Server or Upgrade to Patch 7.

As Temporary workaround we reloaded the box and after reload the issue got resolved of NO Policy Server.

Is there anything we need to look to resolve the Reset instead of going for Patch 7.

Re: No Policy Server Detected

Jason Kunst — Sun, 06 May 2018 11:42:12 GMT

Please take the tac advice as they are tasked with troubleshooting and resolving break fix issues

Re: No Policy Server Detected

Craig Hyps — Sun, 06 May 2018 21:06:14 GMT

I suspect it is a case where posture request sent to PSN that was no longer owner. If a specific defect flagged as being the fix, as we have added some logic to address such out of sync cases, then that would be the path to prevent future occurrences, else rely on ISE 2.2+ feature to provide Phase 2 discovery.