topic Re: ISE and Windows drive mapping scripts in Network Access Control

ISE and Windows drive mapping scripts

Ben.Levin — Mon, 11 Mar 2019 07:26:21 GMT

We are using ISE authentication and posture assessment for VPN and wireless and need to figure out a way to have the drive mappings script run after posture assessment is complete and successful. I know AnyConnect can run scripts but has anyone done this before and is there any documentation on the process? I've read the AnyConnect administration guides but it's not clear what type of scripts can be run and whether the ISE posture module can run the script when it reaches the compliant state. Thanks.

Re: ISE and Windows drive mapping scripts

Darius — Wed, 07 Feb 2018 16:12:40 GMT

Hi,

Did you find any documentation on this?

Re: ISE and Windows drive mapping scripts

abhishek.marat1 — Mon, 12 Feb 2018 19:22:38 GMT

Yes, we do this in our environment.

We have a .bat file:

@echo off
:loop
timeout 2
ping -n 1 DOMAIN |find "TTL=" || goto :loop
echo Answer received.
:loop2
timeout 2
ping -n 1 DOMAIN |find "TTL=" || goto :loop2
echo Answer received.
if not exist U:\ (net use U: \\PATH\%username% /persistent:no)
Exit

You need to name this file as scripts_OnConnect.bat and import it to the ASA.

You need to enable scripting in your AnyConnect Client profile if you are using client VPN. i have attached a screenshot of the option 'enable scripting'. The option can be found under: Please see location.png

Re: ISE and Windows drive mapping scripts

abhishek.marat1 — Mon, 12 Feb 2018 19:29:12 GMT

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/configure-vpn.html

This is one of the links i had used to implement AnyConnect Client VPN posturing using a logon script.

Re: ISE and Windows drive mapping scripts

rashish135@yahoo.co.in — Wed, 06 Jul 2022 04:26:42 GMT

Have you find any solution for " ISE posture module can run the script when it reaches the compliant state"?

I have the same requirement.

Ashish

Re: ISE and Windows drive mapping scripts

Greg Gibbs — Wed, 06 Jul 2022 22:29:46 GMT

ISE 3.1 can run a Powershell or bash script to remediate non-compliance on an endpoint.
https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_compliance.html#task_dlq_gq1_jpb

ISE uses compliance as a condition for authorization to access the network. Running scripts after compliance is not really what ISE is intended to do.

Saying that, you could always suggest a feature enhancement.