topic Re: Exclude Android/iOS Phones in ISE Posture in Network Access Control

Exclude Android/iOS Phones in ISE Posture

LKL4 — Mon, 09 May 2022 19:17:04 GMT

Hello team,

Hope everyone is well.

I want to ignore mobile phones like Android and Iphone from posture and i want to know the best way to perform this.

Actually, i have one SSID (eap-tls) to validate the certificate of my employees notebooks and im checking a few rules with posture module... I want to connect a few phone devices to this same ssid and i want to know the best method for this devices not trigger the "Unkwnows" status in posture. Any tips?

Attached are my 'Policy Sets' and 'Client Provisioning'.

Thanks!!

Re: Exclude Android/iOS Phones in ISE Posture

Marcelo Morais — Mon, 09 May 2022 20:38:39 GMT

Hi @LKL4 ,

try the following:

1st at Work Centers > Profiler > Profiling Policies, check if the Android and Apple-iPhone policies are enabled.

2nd at Policy > Policy Sets > Authorization Policy, create the following Condition (as an example):

a. (EndPoints.EndPointPolicy Not Equals Apple-Device:Apple-iPhone OR EndPoints.EndPointPolicy Not Equals Android) AND Session.PostureStatus Equals Compliant

b. (EndPoints.EndPointPolicy Not Equals Apple-Device:Apple-iPhone OR EndPoints.EndPointPolicy Not Equals Android) AND Session.PostureStatus Equals Unknown

Hope this helps !!!

Re: Exclude Android/iOS Phones in ISE Posture

Leo Laohoo — Mon, 09 May 2022 22:15:49 GMT

Random MAC address renders this null and void.

Re: Exclude Android/iOS Phones in ISE Posture

LKL4 — Thu, 12 May 2022 12:39:16 GMT

Hello @Marcelo Morais

Thanks for the support. I will test these rules n my lab.

If i need to add more devices than android/apple in this network with posture, what would you recommend? maybe a new network is needed for non-postured devices?

Re: Exclude Android/iOS Phones in ISE Posture

Marcelo Morais — Thu, 12 May 2022 19:57:45 GMT

Hi @LKL4 ,

what kind of devices are you planning to add?

Regards