topic Re: ISE 2.4 Hardware_Attributes_Check in Network Access Control

ISE 2.4 Hardware_Attributes_Check

dgaikwad — Wed, 04 Mar 2020 11:09:46 GMT

Hi Experts,
In ISE 2.4, I see this posture condition, Hardware_Attributes_Check.

But inside there are no other parameters to tune with?
How and when to use this posture condition?
Or what are the applicable use case when it comes to using this condition?

Thank you,

Re: ISE 2.4 Hardware_Attributes_Check

Colby LeMaire — Wed, 04 Mar 2020 22:46:18 GMT

I believe that condition is configured when you want to collect hardware information from your client machines. The information would then be available in the Hardware Tab of the Context Visibility dashboard. Following is a link to the hardware dashboard:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#TheHardwareTab

Hardware attributes would be collected for both compliant and non-compliant machines. I haven't used this condition before but I believe it would be one of those conditions that always pass. It is more so just to tell the Anyconnect Posture agent to grab the information and report it to ISE.

Re: ISE 2.4 Hardware_Attributes_Check

dgaikwad — Thu, 05 Mar 2020 08:05:14 GMT

Will this negate the use of device sensors and DNS and DHCP profiling which is configured over SSDIs?

Re: ISE 2.4 Hardware_Attributes_Check

Colby LeMaire — Thu, 05 Mar 2020 13:11:28 GMT

Not at all. Device sensor is used for profiling. The hardware attributes are really just used for asset tracking and reporting on the hardware dashboard.

Re: ISE 2.4 Hardware_Attributes_Check

dgaikwad — Mon, 09 Mar 2020 05:38:29 GMT

Thank you! That does really clear up a lot of things for me.
It is something of great value to the organization.

Re: ISE 2.4 Hardware_Attributes_Check

Taylor Cook — Wed, 21 Oct 2020 19:24:44 GMT

Colby,

Do you know how the information acquired for an endpoint via this Hardware Tab can be exported? I have successfully gathered information using the Temporal agent on multiple workstations, but when performing an export of Endpoints via the GUI or "application configure ise -> option 16" via the CLI, I do not see the Serial Number data which is visible in the hardware tab.

Re: ISE 2.4 Hardware_Attributes_Check

Colby LeMaire — Wed, 21 Oct 2020 21:53:33 GMT

You can try to run a posture report from Operations->Reports and see if that information is there. Export the report to a repository and open in Excel to see what it has. That is probably the only way that I can think of.

Re: ISE 2.4 Hardware_Attributes_Check

Rustam Akhmetzyanov — Wed, 02 Jun 2021 07:17:28 GMT

Hello.
Can you help me please? I don`t understand how to add devices of other operating systems (android, linux). And in the Policy/posture section I can choose only windows or mac.

Re: ISE 2.4 Hardware_Attributes_Check

dgaikwad — Wed, 02 Jun 2021 09:18:03 GMT

Because the posture policies are for only Windows and MacOS, if you want to posture android or iOS devices, then you would need to integrate a MDM solution with ISE.

As far as know, as off now, Linux is not supported for posture as well.