topic Re: Patch ISE condition in Network Access Control

Patch ISE condition

srikkulk — Mon, 21 May 2018 08:35:25 GMT

I’m reaching out in need of some support with an issue I am facing with a customer ISE project.

Customer has Landesk Version 10 Security Patch Manager by which they push Windows Security Patches to all endpoints. They have two requirements.

Run a posture check for Landesk App installation and running services.
Check for Latest critical patches installation and remediate if not installed. (Under Conditons\Patch Management Conditions\Vendor=Landesk\Up to Date\Critical Patches.

I have created policies for Rule 1 and 2. Rule 1 works well and detects the running application. Rule 2 testing was done on 2 machines.

First machine with latest patches installed and the posture status was compliant.
Second Machine was without the latest patches (uninstalled 5 recent security patches, Control Panel/View Installed Updates).

Issue: For the second machine, even though the patches weren’t latest, the status became back as compliant. I checked the reports on ISE and saw that ISE was passing the critical patches condition for Landesk successfully. Didn’t get any more details. How is Anyconnect checking the installation of critical patches through Landesk. Is it integrated with the Landesk Client on PC and checks with the server for comparison?

Please provide any inputs on how to mitigate this issue. Also the best way to check if latest patches are installed.

Re: Patch ISE condition

hslai — Tue, 22 May 2018 04:14:56 GMT

Cisco AnyConnect ISE Posture Windows Support Charts for Compliance Module v4.2.1538.0 shows that LANDESK Software, Inc.'s Security and Patch Manager 9.x required CM 4.2.1331.0 minimal and has support for

Activate GUI Remediation
Up-to-date Check
Application Running Check
Application Kill

Yes, the remediation is generally done through the patch management client. Thus, please also check the logs on the LANDESK side. If you need further details, please get a copy of the DART file and submit it to Cisco TAC.

Re: Patch ISE condition

srikkulk — Tue, 22 May 2018 05:32:59 GMT

Thanks. I'm using CM 3.6.x which is recently updated than 4.x and support Landesk version 10.

But im still getting posture status as compliant even when patches are missing. Any idea why that is happening?

Re: Patch ISE condition

Peter Koltl — Tue, 21 Jan 2020 10:08:46 GMT

Cisco AnyConnect ISE Posture Windows Support Charts for Compliance Module v4.2.1538.0

Link broken...too bad Cisco removes the older Compliance Module support charts from the portal

Re: Patch ISE condition

Mauritz — Mon, 26 Sep 2022 17:40:03 GMT

You can get the updated link, for the last Compliance Module, here: https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-device-support-tables-list.html