topic Cisco ISE VPN POSTURE notworking in Network Access Control

Cisco ISE VPN POSTURE notworking

aslam.bajwa — Thu, 21 Nov 2019 15:37:03 GMT

Hi All ,

i have cisco ISE SSH VPN , posture scan i snot working .

on Anyconnect Posture module showing '' No Policy Server Detected ''

from the End-point -CMD , nslookup to the ISE server FQDN is showing timeout (Screenshot is attached )

Re: Cisco ISE VPN POSTURE notworking

Rob Ingram — Thu, 21 Nov 2019 15:46:09 GMT

Hi,
If you cannot resolve DNS names, are you pushing down a DACL which could be blocking DNS? Try without applying the DACL to the user session to determine if a DACL issue.

Re: Cisco ISE VPN POSTURE notworking

Mike.Cifelli — Thu, 21 Nov 2019 19:03:23 GMT

More than likely this is a dacl issue as already mentioned. You have options within ISE to statically set the ip in the authz profile that would help eliminate the name resolution issue as a connectivity test. Obviously your restricted area must be able to reach your ISE PSN that will be performing the posture checks. Something else you could try as a quick test is using your hosts file locally if you are running Windows to statically provide dns. As far as CoA things are concerned for applying different dacls etc. make sure that udp port 1700 is not blocked along the path between your NAD & ISE OR for VPN between your ASA & ISE. HTH!

Re: Cisco ISE VPN POSTURE notworking

Jason Kunst — Fri, 22 Nov 2019 15:14:52 GMT

@Mike.Cifelli wrote:
More than likely this is a dacl issue as already mentioned. You have options within ISE to statically set the ip in the authz profile that would help eliminate the name resolution issue as a connectivity test. Obviously your restricted area must be able to reach your ISE PSN that will be performing the posture checks. Something else you could try as a quick test is using your hosts file locally if you are running Windows to statically provide dns. As far as CoA things are concerned for applying different dacls etc. make sure that udp port 1700 is not blocked along the path between your NAD & ISE OR for VPN between your ASA & ISE. HTH!

yes and also checked out the https://cs.co/ise-guides

in particular the one titled ISE Posture Prescriptive Deployment Guide

If still having issues please work through tac