topic Re: Automatic Posture Reassessment in Network Access Control

Automatic Posture Reassessment

Guy Greenshtein — Thu, 31 Aug 2023 06:57:51 GMT

Hello,

I'm looking for a way to configure automatic posture reassessment using AnyConnect client on workstations every X minutes.

This is required to ensure that the workstation is compliant and if a change to the posture policy was made it would be propagated to and initiate a rescan.

I know the Reassessment configuration (PRA) and Posture Settings, but the lowest interval is 60 minutes which is a lot in our case.

Re: Automatic Posture Reassessment

hslai — Fri, 01 Sep 2023 04:46:43 GMT

@Guy Greenshtein We do not recommend performing PRA more frequently than every 4 hours. In case of a posture-policy change, you may use Session Reauthentication API or the like to get them re-evaluated.

Re: Automatic Posture Reassessment

Guy Greenshtein — Sat, 02 Sep 2023 14:22:37 GMT

Hi, thank you for your reply.

I believe that there must be a way to send the same re-authentication command using GUI - under Context Visibility > CoA Reauthentication.

The problem is that it is only valid for endpoints having an active session with ISE PSN and it requires a manual intervention. I was hoping that there's a way to lower the PRA for less than 60 minutes or trigger this automatically within built-in configuration and not API.

Re: Automatic Posture Reassessment

hslai — Sun, 03 Sep 2023 02:02:00 GMT

@Guy Greenshtein PRA is not for this. Besides, it also needs active sessions.

Re: Automatic Posture Reassessment

Guy Greenshtein — Sun, 03 Sep 2023 15:00:35 GMT

In that case I'd like to get a clarification, because based on Cisco's documentation it fits our needs.

If not PRA, what do you recommend beside of API?