topic Re: Cisco ISE 2.4 Posture Client Version/OS Control in Network Access Control

Cisco ISE 2.4 Posture Client Version/OS Control

awatson20 — Thu, 07 Jan 2021 19:12:10 GMT

With ISE 2.4, is it possible to perform posture assessment for BYOD and Guest clients where the condition involves checking the browser version or OS version to ensure compliance? Is the Anyconnect agent required for the posturing?

Re: Cisco ISE 2.4 Posture Client Version/OS Control

pavagupt — Fri, 08 Jan 2021 07:47:31 GMT

Posture supports Windows and macOS operating systems. As long as BYOD and Guest devices are operating on these OS, it is possible for you to assess posture of the devices. Refer to Posture perspective deployment Guide for more details on different options.

if you don't want AnyConnect persistent agent to be installed, you could make use of AnyConnect temporal agent. But has limitation on supported posture checks. Refer to 2.4 admin posture guide

Re: Cisco ISE 2.4 Posture Client Version/OS Control

awatson20 — Fri, 08 Jan 2021 14:13:41 GMT

Can you elaborate on what this means?

Set Posture Status for Nonagent Devices

You can configure the posture status of endpoints that run on non-agent devices like Linux or iDevices. When Android devices and Apple devices such as an iPod, iPhone, or iPad connect to a Cisco ISE enabled network, these devices assume the Default Posture Status settings.

Re: Cisco ISE 2.4 Posture Client Version/OS Control

pavagupt — Fri, 08 Jan 2021 15:09:48 GMT

For non-supported devices like iPod, iPhone going through posture, ISE gives access based on the Administration > System > Settings > Posture > General Settings > Default Posture Status settings. i.e if it is set to Compliant, non-supported devices gets compliant access.