topic ISE posture check fails in Network Access Control

ISE posture check fails

peter.matuska1 — Thu, 22 Mar 2018 15:09:27 GMT

hi, we have a problem with posture failing when the PC is connected behind the cisco ip phone. The problem is like this:

the ip phone powered via PoE suddenly loses connections and turns off -> port is down. So the port on PC goes down as well.

When the phone powers up, the port on the PC goes up as well and the whole process starts -> authentication and posture check. The problem is that during the boot up process of the phone, the phone goes down again (seen on the switch and PC) but the posture is still in progress and sometimes it tries to send the result of the posture check when the port is down so the posture fails with notification Failed to contact policy server. Contact your system administrator. There is also Try again button to run the posture again. And sometimes the posture finishes successfully. Is there any way to set up some kind of backoff timer and start the posture check 15seconds after the interface goes up?

thank you

Re: ISE posture check fails

imbashir — Thu, 22 Mar 2018 23:24:05 GMT

Discover timer values from agent side are very much hard-coded and not configurable via UI, I would recommend exploring the option of posture-lease with PRA of min values

Thanks

Imran

Re: ISE posture check fails

peter.matuska1 — Fri, 23 Mar 2018 06:45:35 GMT

Hi, we do not use PRA because of this: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf20208/?rfs=iqvred

Video Link : 16958

Re: ISE posture check fails

peter.matuska1 — Thu, 29 Mar 2018 12:09:07 GMT

updated post with video

Re: ISE posture check fails

Jason Kunst — Thu, 29 Mar 2018 13:11:13 GMT

I would suggest you work with the tac on debugging and coming up with a solution to this

They will look at agent logs suggest fixes and open bugs where needed