topic Re: Anyconnect Posture Package in Network Access Control

Anyconnect Posture Package

Srinivasan Nagarajan — Sat, 08 Jan 2022 14:35:22 GMT

Hi Experts,

With the Anyconnect mobility client (pre-deploy package), we've got an ISE pre-posture (host scan) and posture module. In addition to that, Cisco offers a Compliance module as well. As far as I know, compliance module is performing the posture assessment. Can you please suggest how a ISE posture module is different from the compliance module?

Thank you.

anyconnect-win-4.10.03104-iseposture-predeploy-k9
anyconnect-win-4.10.03104-posture-predeploy-k9

Re: Anyconnect Posture Package

Rob Ingram — Sat, 08 Jan 2022 16:15:15 GMT

@Srinivasan Nagarajan the ISE Posture module and Posture (hostscan) module are different and should not be used together. The Hostscan module is for posture assessment against an ASA.

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect45/administration/guide/b_AnyConnect_Administrator_Guide_4-5/configure-posture.html

The ISE posture module relies on the compliance module, which contains the list of supported antimalware and firewall for ISE posture.

Re: Anyconnect Posture Package

Srinivasan Nagarajan — Sat, 08 Jan 2022 16:33:42 GMT

Hi Rob,

Thanks for the reply. I'd like to get clarified on the ISE posture module and compliance module.

While compliance module is responsible for performing the posture assessment on the endpoints, not sure what is the ISE posture module (which is part of Anyconnect pre-deployment package) is responsible for?

anyconnect-win-4.10.03104-iseposture-predeploy-k9 >> ISE Posture

anyconnect-win-4.3.1728.6145-isecompliance-predeploy-k9 >> Compliance Module

Re: Anyconnect Posture Package

Rob Ingram — Sat, 08 Jan 2022 17:06:34 GMT

@Srinivasan Nagarajan the ISE Posture module is the agent that appears in AnyConnect as a tile, this module establishes communication with the ISE Policy servers, receives information about posture requirements from the ISE and provides report to the ISE regarding requirments status.

More information

https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273

Re: Anyconnect Posture Package

Srinivasan Nagarajan — Sat, 08 Jan 2022 17:18:07 GMT

Hi @Rob Ingram

Many thanks for your time in replying to this.

"the ISE Posture module is the agent that appears in AnyConnect as a tile, this module establishes communication with the ISE Policy servers, receives information about posture requirements from the ISE and provides report to the ISE regarding requirements status"

- This is the compliance module (tile system scan) which is responsible to perform the above checks.

But the below ISE posture module which is part of Anyconnect pre-deploy and I'd like to get clarified on the below?

anyconnect-win-4.10.03104-iseposture-predeploy-k9

Re: Anyconnect Posture Package

Rob Ingram — Sat, 08 Jan 2022 17:35:30 GMT

@Srinivasan Nagarajan

AnyConnect ISE Posture module = anyconnect-win-4.10.03104-iseposture-predeploy-k9

Compliance Module = anyconnect-win-4.3.2290.6145-isecompliance-predeploy-k9.msi

I'm not sure what else you need clarification on?

Re: Anyconnect Posture Package

Srinivasan Nagarajan — Sat, 08 Jan 2022 17:51:04 GMT

Hi @Rob Ingram

As Compliance module (system scan) is performing the posture checks, I'd like to know about the ISE posture module (which is part of Anyconnect pre-deploy) and what is it responsible for 🙂

Re: Anyconnect Posture Package

Rob Ingram — Sat, 08 Jan 2022 18:02:34 GMT

@Srinivasan Nagarajan I've already explained what the ISE Posture module is reponsible for. The ISE Posture module is the agent that appears in AnyConnect as a tile, this module establishes communication with the ISE Policy servers, receives information about posture requirements from the ISE and provides report to the ISE regarding requirments status.

The ISE posture module relies on the compliance module, which contains the list of supported antimalware and firewall for ISE posture. The compliance module contains a list of fields, such as vendor name, product version, product name, and attributes provided by OPSWAT that supports Cisco ISE posture conditions. Vendors frequently update the product version and date in the definition files, therefore, you must look for the latest version and date in the definition files for each vendor product by frequently polling the compliance module for updates. Each time the compliance module is updated to reflect the support for new vendors, products, and their releases, the AnyConnect agents receives a new library.

These 2 modules work together and have their own roles.

Re: Anyconnect Posture Package

Srinivasan Nagarajan — Sat, 08 Jan 2022 18:07:56 GMT

Hi @Rob Ingram

Many thanks. I got what I needed..

Re: Anyconnect Posture Package

Filip Po — Wed, 18 Dec 2024 12:54:43 GMT

Now, in the Cisco Secure Client 5.x era it is a little bit confusing to use the Compliance Module persist on major release 4 = cisco-secure-client-win-arm64-4.3.4390.8192-isecompliance-predeploy-k9.msi