topic Re: Posture implementation without client provisioning portal in Network Access Control

Posture implementation without client provisioning portal

mnkojima — Thu, 11 May 2023 18:29:14 GMT

Hello

we are implementing ISE with posture in our environment. We do not want to use the client provisioning portal, we will manually install anyconnect and posture module at our laptops.

I have not been able to find a good document on how to do that. I have verified that we will need a file ISEPostureCFG.xml and a ConnectionData.xml but not many details about the posture profile, policy, etc

Can someone please advise?

Thank you

Marcos

Re: Posture implementation without client provisioning portal

Greg Gibbs — Thu, 11 May 2023 22:30:33 GMT

The following document shows the detailed flows for Posture both with and without redirection (supported from ISE 2.2). The screenshots are a bit old, but the same flow and configuration would apply for ISE 3.x.

Compare Earlier ISE Versions to ISE Posture Flow in ISE 2.2

There is also the ISE Posture Prescriptive Deployment Guide for reference.

Re: Posture implementation without client provisioning portal

mnkojima — Sun, 14 May 2023 14:08:46 GMT

Thank you. I read those documents.

We manually installed modules core+vpn and ISE posture. The weird thing is that AC finds the PSN only when we install AC with the file ISEPostureCFG.xml saved in the folder "Profiles" of the installation files (anyconnect-win-4.10.07061-predeploy-k9\Profiles\iseposture). I have not found any reference about this procedure.

Has anyone seen that?

Thank you

Marcos

Re: Posture implementation without client provisioning portal

Greg Gibbs — Sun, 14 May 2023 22:12:49 GMT

That is documented in the AnyConnect Secure Mobility Client Admin Guide.

If you are using the MSI installer, the MSI picks any profile that has been placed in the Profiles folder and places it in the appropriate folder during installation. The proper folder paths are available in the predeployment MSI file available on CCO.
If you are predeploying the profile manually after the installation, copy the profile manually or use an SMS, such as Altiris, to deploy the profile to the appropriate folder.

Re: Posture implementation without client provisioning portal

mnkojima — Mon, 15 May 2023 12:41:46 GMT

Thank you Greg