topic Client Provisioning Policies in Network Access Control

Client Provisioning Policies

Anthony O'Reilly — Tue, 05 Oct 2021 16:14:11 GMT

Hi,

I have a customer that has laptops and desktops with different AnyConnect versions and compliance modules. They currently have wireless posturing working for wi-fi only.

Device	Wireless/Wired	AnyConnect Version	Compliance Module	Policy	Identity Groups
Laptop	Wireless	4.8.03036	4.3.1453.6145	Use existing policy	None
Laptop	Wired	4.8.03036	4.3.1453.6145	Need new policy that looks at only laptops on the LAN that doesn't conflict with desktops	None
Desktop	Wired	4.10.02086	4.3.2336.6145	Need new policy that looks at desktops on the LAN and it doesn't conflict with laptops	None

Possibly three profiles on ISE required:

Wireless – use the same one – same compliance module
Wired – Laptop – use same compliance module as wireless setup, this is so the laptop will not have two different compliance module (avoid conflicts in software versions)
Wired – Desktop - use new compliance module (highlight in green in table above)

Need a policy to determine if the device is a laptop/desktop and if it is laptop only go to Wired Laptop policy. I was going to suggest an AD group as a condition for Laptops and one for desktops and build them into the policy.

Is there any better way of doing this?

Re: Client Provisioning Policies

Mike.Cifelli — Tue, 05 Oct 2021 16:32:01 GMT

Is there any better way of doing this?

-IMO there are many ways to differentiate, but this really comes down to what you feel is best fit for your environment. As you alluded to the external AD group is one I often see used in other condition and could very well be the easiest. Perhaps you have each of the three in separate security groups already. Are devices static that never move around campus? Perhaps you could rely on device type or location if all three are subject to same areas? Lastly, 4.8 is ancient you should really look into upgrading the AC client. HTH!

Re: Client Provisioning Policies

Anthony O'Reilly — Wed, 06 Oct 2021 08:03:44 GMT

Hi Mike,
We currently don't use security groups.
4.8 will be upgraded at the beginning of next year (hopefully)
Laptop users roam around the buildings and branches but desktops are static.

Re: Client Provisioning Policies

Mike.Cifelli — Wed, 06 Oct 2021 11:59:43 GMT

@Anthony O'Reilly your best bet is to take a detailed radius live log for each of the 3 use cases and identify potential conditions that you could test/use to meet your need.