topic Re: Passive-ressessment issue in Network Access Control

Passive-ressessment issue

Attila Horvath — Thu, 05 Oct 2017 15:03:21 GMT

Hi,

Tried to implement 1 day Posture lease time with 4 hours PrA.

If I switch on Reassessment Enforcement, and re-connect a Compliant machine again to net,

it is force a posture check every time.

At ISE posture logs I see a Compliant entry ("Bypass posture since the endpoint is compliant" ),

but immediately afterwards I see a

PRA INFO: PRA is starting

and after this the client preforms a complete re-check.

Why?

Re: Passive-ressessment issue

kthiruve — Thu, 05 Oct 2017 18:54:29 GMT

Hi.

Please make sure the you have a authz policy with condition that includes session: Agent-request-type = Periodic reassessment.

Periodic reassessment requires machine to be compliant and also choose the appropriate option when configuring Periodic reassessment

from Administration~~>System~~>Setting~~>Posture~~>Reassessment, choose the enforcement type continue.

Thanks

Krishnan

Re: Passive-ressessment issue

hslai — Sat, 21 Oct 2017 23:34:56 GMT

What you are seeing is expected. Since the initial posture is by-passed due to posture lease, the user will get compliant access right away and then PrA will kick off in place of the initial assessment to start off the timer.