topic Re: Cisco ISE Pre and Post Posture in Network Access Control

Cisco ISE Pre and Post Posture

aslam.bajwa — Sun, 06 Oct 2019 10:00:19 GMT

Hi All ,

we have cisco ISE 2.4 , Distributed deployment with Wired , Wireless and VPN.

currently we have Pre-Posture configuration ( i.e. we have to enable http server on Cisco Switches for redirect ) .

can we move to Post-posture configuration ? currently we have more then 800 hundred users in production ..

what cisco best practices says ? should we go for Post-Posture configuration

Regards ,

Re: Cisco ISE Pre and Post Posture

Rob Ingram — Sun, 06 Oct 2019 10:13:27 GMT

Hi,

I assume you referring to post ISE 2.2 posture which does not require a redirect? You need to pre-provision the AnyConnect client and the ISEPostureCFG.XML configuration file, this need to be configured with call home list in order to start the posture process. Reference here.

HTH

Re: Cisco ISE Pre and Post Posture

aslam.bajwa — Sun, 06 Oct 2019 10:43:27 GMT

Hi RJI ,

many thanks for your reply .

correct , i am asking about post ISE 2.2 posture , but my man concern is what is the cisco best practices and recommendations.

Pre-Posture or Post posture

Re: Cisco ISE Pre and Post Posture

Rob Ingram — Sun, 06 Oct 2019 11:21:59 GMT

Well if you control the endpoints and can pre-deploy the configuration xml file and anyconnect posture client, you don't need the redirect ACL. Which saves on configuration and complexity. You can also manually provision the client, but browsing to the CPP webpage.

However if haven't pre-deployed the anyconnect client and xml configuration file and you want the client to automatically be redirected to the CPP to provision the agent and configuration then you will need the redirection ACL.

So it's not necessarily about best practice, it's about your scenario and if the endpoints have the configuration/agent. Ideally IMO you'd pre-deploy the necessary configuration files and anyconnect agent, then you don't need the redirection ACL but just rely on the call home list.

Re: Cisco ISE Pre and Post Posture

Jason Kunst — Mon, 07 Oct 2019 16:44:18 GMT

Please also look at the ISE posture guide and no redirect option
https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/210523-ISE-posture-style-comparison-for-pre-and.html