topic Re: AnyConnect Posturing on Virtual Machine in ESXi in Network Access Control

AnyConnect Posturing on Virtual Machine in ESXi

leighharrison — Wed, 30 Sep 2020 10:01:54 GMT

Hello Folks,

We've got a Windows 10 VM running in ESXi that we want to be able to run posturing on and push a remediation vlan to it if it's out of compliance. The VM sits in a host and is connected via a VDS.

Is there any way of ISE pushing a COA for a VLAN to a VDS that anyone has come across?

Best, Leigh

Re: AnyConnect Posturing on Virtual Machine in ESXi

Colby LeMaire — Wed, 30 Sep 2020 13:54:48 GMT

VMware VDS is not a supported access switch for ISE or 802.1x. It does not support RADIUS so you cannot send down AV pairs to change VLAN or assign a dACL. And most VMware environments will have the VDS connected to the physical infrastructure using trunk ports which should not be configured for 802.1x.

Now I have used VM's for testing ISE and posture and it works just fine. The catch is that you need to have a physical NIC on the ESXi host dedicated to the VM and then that NIC plugs into a supported access switch. Then from the switches perspective, it is just another 802.1x supplicant/client and you can do VLAN assignment on the access switch. This scenario works fine for lab testing but is not something you would come across in production since it basically defeats the purpose of virtualization.

Re: AnyConnect Posturing on Virtual Machine in ESXi

leighharrison — Wed, 30 Sep 2020 14:40:26 GMT

Hi Colby,

Many thanks for your response. That’s the way we’re leaning with a dedicated NIC.

Best, Leigh

Re: AnyConnect Posturing on Virtual Machine in ESXi

Colby LeMaire — Wed, 30 Sep 2020 20:45:31 GMT

Leigh - The other thing I would add is that dynamic VLAN assignment is not recommended for Windows machines. Especially if they are part of a domain. When you change VLAN's, that means your IP address changes also. This can break GPO's, login scripts, drive mappings, etc. The recommendation would be to use a remediation dACL to restrict access and then once compliant, push down a new dACL that allows full access. In that scenario, the IP address of the client never changes, only the access they have.

Re: AnyConnect Posturing on Virtual Machine in ESXi

leighharrison — Wed, 30 Sep 2020 23:07:26 GMT

Thanks Colby, Great tip!