topic Re: [Cisco ISE] Posture Status Unknown but AnyConnect as Compliant in Network Access Control

[Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

LKL4 — Tue, 31 May 2022 15:00:04 GMT

Hello team,

We are deploying Posture with Cisco ISE 2.7 (Patch7) and we are facing a strange issue. The machine with AnyConnect report to us the "Compliant" status with Network Access Allowed, but looking through ISE dashboard we receive "Unknown" status and the redirect for the provisioning portal.

- I've already disabled all posture rules, we're not scanning for anything (just software and hardware inventory).

- The CoA is correctly applied in the controller.

- We are using EAP-TLS (machine cert.) for auth..

- The WLC acl works good, redirecting 443, 8443, 8905 and allowing domain.

- The firewall are with any any allowed.

- The Authz. profiles (deny, permit and redirect for provisioning portal looks good too).

- We don't have any kind of posture on the wired network yet.

- Cisco ISE are with 'default posture status' setting as compliant

- Attached are the authz. policy (PNG).

Has anyone experienced something like this?

Thanks!

Re: [Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

hslai — Thu, 02 Jun 2022 03:05:10 GMT

Please check whether the authentication, accounting, and posturing all done on the same ISE PSN node. Likely you need engage TAC to troubleshoot further.

Re: [Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

LKL4 — Mon, 06 Jun 2022 12:43:47 GMT

Hello @jhsl,

We are running ise with just one node (standalone) and TAC already involved in this analysis.

Re: [Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

LKL4 — Wed, 08 Jun 2022 12:59:13 GMT

Just adding the solution for my issue:
This is the new bug matching this behavior: CSCwa99904 17.6.2 || 9800 WLC Deletes Client when DHCP RELEASE is sent by client during Posture.

Re: [Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

LC.IT — Tue, 27 Sep 2022 22:21:39 GMT

@LKL4 did the workaround fix the problem described on CSCwa99904?

Re: [Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

LKL4 — Wed, 28 Sep 2022 00:15:24 GMT

Hello @LC.IT

Yes, in my case we were able to work around this by setting PMF to disabled (moved from WPA2+WPA3 to WPA+WPA2).

Re: [Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

LC.IT — Wed, 28 Sep 2022 00:57:03 GMT

Great! I appreciate your reply.