topic Anyconnect is not triggering scan in Network Access Control

Anyconnect is not triggering scan

osman869 — Fri, 26 Aug 2022 15:05:56 GMT

Hi,

I have a machine when I restart the anyconnect doesnt perfom rescan

Machine A (Problematic)

Machine restart
AnyConnect shows compliant (Policy server detected shows Node2)
There is no COA (as per my policy if the PC is compliant the COA will occur)
I need to run the scan manually
It scans and shows compliant again (this time is goes to Node1)
COA works

Machine B (ideal)

Restart the machine
Scan will trigger(Policy server is Node1)
COA will occur

Sometimes Machine A also works (Policy server stays Node 2) by re-scanning. Is there anything to check on node 2?

I cannot diagnose the issue. Machine B is working ideally.

Thanks

Re: Anyconnect is not triggering scan

Marcelo Morais — Sat, 27 Aug 2022 04:38:29 GMT

Hi @osman869 ,

at Work Centers > Posture > Client Provisioning > Client Provisioning Policy double check the Rule that your Machine A is hitting, check if it is the same Rule as Machine B.

Also double check if Machine A has the correct ISEPostureCFG.XML (at C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture\).

Hope this helps !!!

Re: Anyconnect is not triggering scan

hslai — Tue, 30 Aug 2022 00:29:19 GMT

The problematic client machine A is switching from one PSN to another during compliance checks and such is indicating that the AnyConnect has not discovered the correct PSN initially. Take a look at https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html