Need help with ISE posture

MedTek26 — Thu, 09 Nov 2023 23:56:23 GMT

Dear Cisco community,

After setting up the temporal agent and configuring the different authorization profiles and Policy Sets, I proceed to test it on a client.

Initially, everything functions as expected, but an issue arises after the compliance check phase.

As you can see in the screenshot above : regardless of whether the device is compliant or not, Cisco ISE won't progress beyond the authorization policy stage. Ideally, it should apply the appropriate authorization profile based on the device's compliance status. Resulting in sending a Blank CoA without any attributes other than ACCESS ACCEPT.

Authentication Policy :

Authorization Policy :

Client PoV :

Under the live session the posture status is blank :

Under the contexte visibility :

Report :

The client is a VM and dosent have the Windows firewall activated and is up to date.
I am using the latest Cisco ISE-3.2.0.542a-virtual-SNS3615-SNS3655-300

If anyone already had experienced that or have hints to share with me, that could help me a lot and would be greatly appreciated.

Thank you !

Regards,

Mehdi

Re: Need help with ISE posture

hslai — Sat, 11 Nov 2023 03:33:35 GMT

@MedTek26 The identity column showed as INVALID so that means the auth was not successful so it seems MAB is not configured properly for your Alcatel device.

topic Need help with ISE posture in Network Access Control

Need help with ISE posture

Re: Need help with ISE posture