topic Re: no policy server detected for windows 10 clients - ISE posture 2.4 in Network Access Control

no policy server detected for windows 10 clients - ISE posture 2.4.0.3

anilkumar.cisco — Thu, 30 Sep 2021 11:38:55 GMT

Hello Team,

Cisco VPN Issue with posturing..

All remote window 10 client are affected..

Facing intermittent issue and the workaround is replacing the xml file sometimes resolve the issue or alternatively uninstalling and re-installing the AnyConnect mobile client , posture and compliance module on the window 10 client resolved the issue..

ASA version 9.12(3)12

Anyconnetc desktop window 4.8 version

Anyconnet compliance module 4.3

let me know your suggestion..

Re: no policy server detected for windows 10 clients - ISE posture 2.4

Mike.Cifelli — Thu, 30 Sep 2021 11:53:19 GMT

A few suggestions:

-Generate a DART bundle on a troubled client and check logs

-Setup a test environment, Upgrade AnyConnect to 4.10.x and compliance module to 4.3.1676.0 on a few clients and see if issue goes away

-Rely on CPP to push down ISEPostureCFG.xml for all scenarios

HTH!

Re: no policy server detected for windows 10 clients - ISE posture 2.4

anilkumar.cisco — Thu, 30 Sep 2021 12:07:20 GMT

Hello Mike,

the Cisco AnyConnect ISE compliance module version is 4.3.1513.6145

ISE Posture Module is 4.8.03052

and Cisco AnyConnect Secure Mobility Client is 4.8.03052.

So u want me to upgrade the compliance module to 4.3.1676.0 (manually or in Cisco ISE)

and Cisco AnyConnect Secure Mobility Client is 4.8.03052 to Upgrade AnyConnect to 4.10.x (manually or in Cisco ISE)

what do u mean by Rely on CPP to push down ISEPostureCFG.xml for all scenarios?

if Client provision policy is not able to push ISEPostureCFG.xml, then what should i do?

Re: no policy server detected for windows 10 clients - ISE posture 2.4

Mike.Cifelli — Thu, 30 Sep 2021 13:33:17 GMT

I am suggesting that you setup a test environment to test more up-to-date modules to see if that eliminates your issue. So essentially you will need to setup new CPP to support latest compliance module/AnyConnect (AKA new AnyConnect Config in ISE that is assigned as CPP result), identify a group of test clients and a condition you can utilize to only test against the selected test group. As far as the test clients themselves, you can upgrade manually or rely on ISE to upgrade via webdeploy (choice is yours). The CPP AnyConnect Config result is typically responsible for provisioning/pushing down the xml file to clients. HTH!

Re: no policy server detected for windows 10 clients - ISE posture 2.4

anilkumar.cisco — Sun, 03 Oct 2021 10:30:15 GMT

Hello Mike,

Seems 4.3.1676 Compliance module is available only for Linux/standalone device and with ISE 3.1 and later version..

Pls find the more detail below:-

Software Download - Cisco Systems

anyconnect-linux64-4.3.1676.0-isecompliance-predeploy-k9.tar.gz

This image can be used with AnyConnect version 4.10.(2086) and later along with ISE 3.1 and later.

and hence latest ISE Compliance module available for Windows is

anyconnect-win-4.3.2367.6145-isecompliance-webdeploy-k9.pkg

Which is available for to be used with AnyConnect version 4.3 and later along with ISE 2.1 and later.

Kindly advise, if my understanding is correct.