topic Re: Patch Management with ISE in Network Access Control

Patch Management with ISE

abhvyas — Wed, 02 Aug 2017 09:55:26 GMT

Hello Experts,

I have come across a scenario where patch management for Windows' Machines is getting done through various methods like SCCM, WSUS and sometimes running scripts on end points.

As per my understanding patch management with ISE is performed using AnyConnect integration with ISE, where AnyConnect verifies Critical Patches installation on machine with the help of SCCM Client before giving network access to end point.

Customer doesn't want to ISE to rely on SCCM, stating that due to some issues patches can be missing on SCCM client and hence

want ISE to verify presence of patches on end points using some manual configuration of Windows registry or KB values.

Request you to please help me out if you are aware of any such customisation with ISE for Windows patch validations and suggest if any solution/workaround is available.

Thank you.

Abhishek

Re: Patch Management with ISE

Craig Hyps — Wed, 02 Aug 2017 14:09:32 GMT

There are a number of custom checks for Windows updates that are pushed as part of the Posture rules updates from Cisco. That said, this is typically a much more management intensive route. ISE 2.2 has additional enhancements in 2.2 for checking SCCM checks with external Windows server. I suggest trying to leverage existing WSUS/SCCM integration, or patch management solution to help automate operation.

/Craig

Re: Patch Management with ISE

Bcssi Network — Wed, 24 Jan 2018 13:17:37 GMT

Hi Chyps,

Can you please elaborate more on your response -

"ISE 2.2 has additional enhancements in 2.2 for checking SCCM checks with external Windows server. I suggest trying to leverage existing WSUS/SCCM integration, or patch management solution to help automate operation."

Re: Patch Management with ISE

imbashir — Sat, 27 Jan 2018 01:51:54 GMT

Hello, comment was around enhancements on AC compliance module code to check for all patches instead of just critical patches, recommend using the latest CM module to work with all patch levels

thank you

Regards

Imran.