topic Re: ISE Posture Bad User Experience in Network Access Control

ISE Posture Bad User Experience

Hemant Bharati — Thu, 03 Nov 2016 01:22:43 GMT

Hi All,

I have customer deploying Wireless Infra with Cisco ISE , everyday there are issues with anyconnect posturing example...

1. The time taken is very uneven , sometime it is in 2mins to 45mins or may not connect also .

2. Same user which was compliant in the morning , when move from one campus building to another it goes into non complaint state when want to be on network.

3. Users are complaining that they get disconnected or get pop up page to install Anyconnect even when it is installed.

Can someome help here...

Re: ISE Posture Bad User Experience

hslai — Thu, 03 Nov 2016 01:40:31 GMT

Thanks for the posting. If not done already, please engage Cisco TAC on this. Ask the customer to collect an AnyConnect DART whenever abnormal behavior arise.

Re: ISE Posture Bad User Experience

Hemant Bharati — Thu, 03 Nov 2016 01:44:33 GMT

Cisco TAC is involved ,

Can you please let me know what is the Ideal time taken for Posturing ?

Re: ISE Posture Bad User Experience

hslai — Thu, 03 Nov 2016 01:48:01 GMT

IMHO a minute or two is fine. Anything longer than that, users will complain.

Many things can come into play, tho. Network connectivity (especially in wireless), types of posture conditions (Microsoft patch checks can take a long time, for example) and means of remediations.

Re: ISE Posture Bad User Experience

imbashir — Fri, 04 Nov 2016 17:17:23 GMT

Typical posture times are certainly much less than the ones reported

I would suggest leveraging posture features like Posture Lease + Passive Re-Assesment which would limit posture checks at every install time but would still check posture at a configured interval

I'm not sure why are users getting un-install option, could be that Firewall is also configured to install AC and there are version inconsistencies

Thanks

Imran