topic Re: Cisco ISE Version 3.0 posture provisioning in Network Access Control

Cisco ISE Version 3.0 posture provisioning

bunleang — Fri, 04 Feb 2022 08:31:11 GMT

Hi all ISE experts,

Anyone could tell me how to apply dacl profile to clients while posture scan found device non-compliance

- non-compliance devices blocked access to the internal system

- non-compliance internet must be accessible

Re: Cisco ISE Version 3.0 posture provisioning

Milos_Jovanovic — Fri, 04 Feb 2022 10:51:11 GMT

Hi @bunleang,

This sounds like a standard scenario for posture assessment.

Please check ISE Posture Prescriptive Guide to understand concepts and to see how to implement it.

BR,

Milos

Re: Cisco ISE Version 3.0 posture provisioning

Mike.Cifelli — Fri, 04 Feb 2022 12:20:06 GMT

Anyone could tell me how to apply dacl profile to clients while posture scan found device non-compliance

-You will need a separate authz profile, which contains your desired dacl, that you will use in your radius authorization policy for noncompliant clients. Your conditions in the authz policy will contain Session:Posture Status EQUALS NonCompliant. Then for the result profile assign the authz profile for noncompliant use cases that contains your respective dacl.

Authz/dacl can be created here: Policy->Policy Elements->Results->Authorization

Re: Cisco ISE Version 3.0 posture provisioning

bunleang — Tue, 15 Feb 2022 15:46:14 GMT

Could you share me sample guide with auth dacl access-list rule?

Re: Cisco ISE Version 3.0 posture provisioning

Mike.Cifelli — Tue, 15 Feb 2022 16:01:57 GMT

I would recommend looking at the guide @Milos_Jovanovic shared and this one: https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

Re: Cisco ISE Version 3.0 posture provisioning

Aref Alsouqi — Tue, 15 Feb 2022 17:32:43 GMT

Personally I would apply the following rules on the non-compliant DACL, you can narrow them down if you want:

permit udp any eq bootpc any eq bootps

permit udp any any eq 53

deny ip any 10.0.0.0 0.255.255.255

deny ip any 172.16.0.0 0.15.255.255

deny ip any 192.168.0.0 0.0.255.255

permit tcp any any eq 80

permit tcp any any eq 443

deny ip any any

Keep in mind please that if you want to apply the above DACL to an old WLC, then you need to create the ACL on the WLC, and from ISE authorization profile instead of enabling the check on the "DACL Name" and select the DACL, you would need to enable the "Airespace ACL Name" and provide the name of the ACL you created on the WLC.

Re: Cisco ISE Version 3.0 posture provisioning

bunleang — Wed, 16 Feb 2022 02:11:21 GMT

Look great let me narrow it down and try with this rule, then I will let you know the result. Thank