topic Re: ISE 3.1 lease setting and devices on 24x7 in Network Access Control

ISE 3.1 lease setting and devices on 24x7

cgarringer — Mon, 27 Feb 2023 21:22:50 GMT

We are running ISE 3.1 patch 4 and rolling out wired connections with posture checking. the issue we are seeing is with computers on 24x7 , we are a manufacturing plant. With the lease setting at 24 hrs, and the the posture recheck at 12 hours, the computers will scan for posture automatically once at the end of 12 hours, but when the lease expires a user must login and select re-scan to get the device online. Has anyone had devices that have to stay on 24x7 for up to months on ISE? What did you do about the lease and rescan for posture?

Re: ISE 3.1 lease setting and devices on 24x7

balaji.bandi — Mon, 27 Feb 2023 22:45:52 GMT

if that causing the issue, if the industrial device is trusted, I will create a different profile and disable posture checks.

Re: ISE 3.1 lease setting and devices on 24x7

cgarringer — Mon, 27 Feb 2023 22:54:25 GMT

For the devices that would work but a significant portion of the systems are Windows PC’s that need to be checked for compliance.

Re: ISE 3.1 lease setting and devices on 24x7

balaji.bandi — Tue, 28 Feb 2023 00:01:20 GMT

so all windows PC are the industrial requirements? what windows XP / 7 / 10 or 21H2 ?

Re: ISE 3.1 lease setting and devices on 24x7

cgarringer — Tue, 28 Feb 2023 14:03:39 GMT

Nothing older than 10, most should be 21H2.

Re: ISE 3.1 lease setting and devices on 24x7

Aref Alsouqi — Tue, 28 Feb 2023 14:39:32 GMT

Are you doing the posture assessment via AnyConnect? and are you referring to the lease in the reassessment page or the general posture assessment settings?

Re: ISE 3.1 lease setting and devices on 24x7

cgarringer — Tue, 28 Feb 2023 14:42:25 GMT

The reassessment is set to 12 hours, the general setting is 24. The AD group is looking at a possible solution, they have found that the ISE posture services can be stopped/started and that causes a re-scan that appears to keep the PC connected. They tried it on one machine, they are expanding the test.

Re: ISE 3.1 lease setting and devices on 24x7

Dustin Anderson — Tue, 28 Feb 2023 19:05:26 GMT

I have not tested, will a radius reauth of the port trigger a rescan? We only use AnyConnect for wireless and they tend to bounce on/off all day so never had an issue.