topic Re: ISE POSTURE COA ISSUE in Network Access Control

ISE POSTURE COA ISSUE

tohuindo — Sat, 30 Jul 2022 18:39:31 GMT

Posture is configured, and users must be compliant before being reassigned to their respective vlan. But in order for them to be able to check their posture status they are assigned to a temporary vlan that grant them minimal access to the network.

They match the temporary vlan policy when their eap-chaining is fully successful or when the machine authentication is successful. Now the issue is that most users get in that temporary vlan and received their posture and then a coa is sent so they can leave the temporary policy to go to their appropriate vlan but some users got sticked in that temporary vlan even though they were compliant

Re: ISE POSTURE COA ISSUE

Marcelo Morais — Sun, 31 Jul 2022 12:52:48 GMT

Hi @tohuindo ,

1st double check the Posture Status at Work Centers > Posture > Reports > Reports > Posture Reports > Posture Assessment by Endpoint.

2nd compare the Endpoints that are not OK with the Endpoints that are OK:

a. double check if they have the same Authorization Rule (at Operations > Reports > Reports > Endpoints and Users > RADIUS Authentication).

b. double check if they are in the same SW.

Note: for a better understand of the Posture flow, please check the ISE Posture Flow in ISE 2.2 Compared to Earlier ISE Versions.

Hope this helps !!!

Re: ISE POSTURE COA ISSUE

tohuindo — Mon, 01 Aug 2022 13:49:54 GMT

Thank you for reply i will try to work on it and if anything i will let you know