topic Re: Do I need to install Anyconnect to do Posturing? in Network Access Control

Do I need to install Anyconnect to do Posturing?

James L — Mon, 16 Mar 2020 06:21:40 GMT

Hi. Do I need to procure licenses and install Cisco Anyconnect to all Windows 10 Computers if I want to do Posturing (make sure AV is up to date, OS patched to latest and so forth)?

I don't think I need Anyconnect for Profiling but again just asking... Thanks.

Re: Do I need to install Anyconnect to do Posturing?

balaji.bandi — Mon, 16 Mar 2020 08:33:36 GMT

any connection point of no, but if you are using ISE look at the config and requirement :

https://community.cisco.com/t5/security-documents/how-to-configure-posture-with-anyconnect-compliance-module-and/ta-p/3647768

Re: Do I need to install Anyconnect to do Posturing?

James L — Mon, 16 Mar 2020 09:27:38 GMT

I see. I don’t have an ASA in this environment only a heap of computers that I need to make sure are in the right posture and a couple of ISE Servers.

Going by this URL I think I need to install any connect on the computers.

https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273#toc-hId--1065656773

Re: Do I need to install Anyconnect to do Posturing?

Cristian Matei — Mon, 16 Mar 2020 10:48:52 GMT

Hi,

The post title says "posture", while you're speaking about "profiling". Which one exactly do you need?

- for profilling, AnyConnect is not required; as an advantage, AnyConnect, through ACIDex, allows you to get some more HW/SW information about the endpoint (like SN for example); more detailed data can be obtained through "Asset Visibility", which is an ISE function, does not require AnyConnect

- for posture, you would need to use AnyConnect Agent

Regards,

Cristian Matei.

Re: Do I need to install Anyconnect to do Posturing?

Mike.Cifelli — Mon, 16 Mar 2020 13:00:47 GMT

For posturing you have to have AnyConnect installed on the computers. Take a look at the guide posted earlier. Also, keep in mind you will need ISE Apex licenses for posture features. Pushing authz policy will require 1 ISE base license + 1 ISE apex license. All of this is covered in the ISE posture deployment guide. HTH!