topic Re: ISE - no policy server detected in Network Access Control

ISE - no policy server detected

JustTakeTheFirstStep — Tue, 02 Jul 2019 10:32:12 GMT

Hi. everyone.

I want "Anyconnect system scan" to work on all PCs.

However, some "WINDOW10" does not run "System scan".

PCs that do not have a "system scan" in common have a "no policy server detected" message.

Another commonality is that Security Products does not show anything.

Attach the screenshot below.

Please help me ...

Re: ISE - no policy server detected

Mike.Cifelli — Tue, 02 Jul 2019 12:16:59 GMT

Please share your Client Provisioning Policies so we can better assist. As well as any other information that may better assist us.

Re: ISE - no policy server detected

hslai — Fri, 05 Jul 2019 22:18:12 GMT

This appears a configuration issue. Please check out the following:

Re: ISE - no policy server detected

JustTakeTheFirstStep — Thu, 01 Aug 2019 06:47:38 GMT

Thank you for answer.

I solved this problem.

The cause of the problem was "Discovery host".

I entered the IP of the ASA in the "Discovery host" in the ISE.

The "Discovery Host" caused a redirection problem.

Using "call-home list" instead of "Discovery Host" solved the problem.

TAC recommends the use of "Call-home list".

The reason is that the client communicates directly with the ISE without going through the NAD.

Re: ISE - no policy server detected

ariel_gonzalez — Tue, 12 Nov 2019 15:49:57 GMT

Hi could you shared ASA configuration call home list

Re: ISE - no policy server detected

Mike.Cifelli — Tue, 12 Nov 2019 16:42:33 GMT

In your Posture Agent Profile Settings in ISE the discovery host should be set to the PSN IP Address you wish to use to scan your hosts. As by design here is where you tell the AC agent to connect to your server AKA ISE for posture checks/scan. HTH!

Re: ISE - no policy server detected

ariel_gonzalez — Tue, 12 Nov 2019 17:39:30 GMT

Hi, we used ASA to provision posture module, it work OK, but error appear saying No policy Server detected.

Re: ISE - no policy server detected

misinsuan2229 — Thu, 12 Mar 2020 16:50:21 GMT

Did you left your DH empty on your solution? and only have the Call-home list with the PSN fqdn/ip address?

Re: ISE - no policy server detected

JustTakeTheFirstStep — Thu, 26 Mar 2020 00:58:48 GMT

Sorry for the late response.

Enter IP or FQDN in the call home list.

Re: ISE - no policy server detected

JustTakeTheFirstStep — Thu, 26 Mar 2020 01:00:32 GMT

See the answer above.
I just attached a screenshot.

Re: ISE - no policy server detected

aravikumar — Fri, 10 Apr 2020 04:04:39 GMT

We have a problem where we are still getting no policy server detected on endpoints. We do not have any proxy configured on ISE or endpoints. We have also configured Call home list but we are still facing the issue.

Thanks,

Aravind.

Re: ISE - no policy server detected

subrun.jamil — Tue, 22 Dec 2020 03:24:09 GMT

Hi Snika,

Your provided screenshot is not clear. So at Discovery Host which IP did you configure ?

Re: ISE - no policy server detected

JustTakeTheFirstStep — Tue, 22 Dec 2020 09:07:29 GMT

Enter the ISE IP

Re: ISE - no policy server detected

subrun.jamil — Wed, 23 Dec 2020 19:16:50 GMT

Hello Snika,

What was the version back then when you encountered this issue ?

Re: ISE - no policy server detected

JustTakeTheFirstStep — Thu, 24 Dec 2020 03:16:55 GMT

2.6 patch 1

Are you troubled with this problem?

The method I have presented in this article can be one of many.

In my experience the problem of not finding the server was mostly anyconnect's problem.

You must delete all of the C:\ProgramData\Cisco directory after deleting AnyConnect.

Then reinstall and check the condition again.

Re: ISE - no policy server detected

subrun.jamil — Wed, 03 Feb 2021 21:41:55 GMT

I have 2 PSN and Policy Service Perspective both PSN can serve for. Question is If I use ISEnode1 is Discovery Host , Posture will always be done by ISEnode1 ?

And on what condition User Posture can go to ISENode2 ?

Yes Snika, I have this problem. settings wise I have ISEnode1 in Discovery Host and in the AnyConnect Unknown Compliant Auth Profile it has ISEnode2 as Static Host.

Re: ISE - no policy server detected

Marcelo Morais — Wed, 03 Feb 2021 22:40:52 GMT

Hi @subrun.jamil

a better practice is to place an URL (internal or external URL, for ex.: intranet.company, www.google.com) on the Discovery Host that will trigger the Redirect URL (do not use the PSN).

Note 1: AnyConnect already tries enroll.cisco.com so use a different URL.

Note 2: on the Call Home List you could have: a list of PSNs or Load Balance.

Hope this helps !!!