topic Re: Non-working rules in Cisco ISE for posturing services on MacOS in Network Access Control

Non-working rules in Cisco ISE for posturing services on MacOS

Aleksandr Pashko — Fri, 17 Feb 2023 13:24:26 GMT

Hello everyone!

We need to understand why ISE posture fails on process checks on MacOS.

For example, we need to check that the datalossd or datalosste processes are running. Here is an example of output from one device, where you can see that the processes are running:

This is what the enabled checks look like:

As far as I understand, by design it should not give any error. It's just that the system scan does not consider the process running. He simply does not see him, hence he believes that the condition fails. I attached screenshots of the troubleshoot, but in fact they just say that the air conditioner has failed.

Moreover, each of these checks fails and it is not very clear why.
Perhaps you need to specify the process name in some other way or take it in some other place or with some kind of prefix.
Please help/suggest what we are doing wrong and how to make it work correctly? For example, for windows, if you specify the name of the process, as it is visible in system monitor, then such a check passes successfully.

Re: Non-working rules in Cisco ISE for posturing services on MacOS

Rodrigo Diaz — Fri, 17 Feb 2023 20:54:41 GMT

hello @Aleksandr Pashko, are you using the latest compliance ? if you don't please make sure you are using it in the machines affected , ensure also that the posture feed is also updated within ISE .

Let me know if that helped .

Re: Non-working rules in Cisco ISE for posturing services on MacOS

Rodrigo Diaz — Fri, 17 Feb 2023 20:55:30 GMT

I was referring to the latest ISE compliance module in my latest post.

Re: Non-working rules in Cisco ISE for posturing services on MacOS

Aleksandr Pashko — Mon, 20 Feb 2023 11:19:12 GMT

Hello

thank you for the answer

You mean the compliance module in the AnyConnect for MacOS?

Re: Non-working rules in Cisco ISE for posturing services on MacOS

Aleksandr Pashko — Mon, 20 Feb 2023 11:34:06 GMT

The OPSWAT module version is 4.3.2661.4353

Re: Non-working rules in Cisco ISE for posturing services on MacOS

Rodrigo Diaz — Mon, 20 Feb 2023 16:28:40 GMT

yes I meant that module .

Re: Non-working rules in Cisco ISE for posturing services on MacOS

Aleksandr Pashko — Tue, 21 Feb 2023 19:29:47 GMT

The OPSWAT module version is 4.3.2661.4353