topic Re: Cisco ISE Unknown or Pending Timeout in Network Access Control

Cisco ISE Unknown or Pending Timeout

abarkley — Thu, 16 May 2024 17:02:40 GMT

Good afternoon,

Does anyone know of way to configure a timeout or time limit for an endpoint to be in a Pending or Posture Unknown state?

We are concerned about credential theft and unauthorized devices remaining in this state with access.

Thank you

Re: Cisco ISE Unknown or Pending Timeout

Arne Bier — Fri, 17 May 2024 00:16:12 GMT

I suppose you could start with returning a Session-Timeout in your ISE Authorization Profile. When that timer expires, then the client will be re-auth'd and then it will be re-assessed. I am not experienced with Posture flow, but how would you like to handle endpoints that exceed their allotted time during posture assessment?

The Posturing Prescriptive Guide might have some insights.

Re: Cisco ISE Unknown or Pending Timeout

Ambuj M — Fri, 17 May 2024 01:18:43 GMT

I haven't played around with these setting, but you can try

Administration > Settings > Posture > General Settings:

there is continuous monitoring setting, which basically states how frequently any connect will send status update to ISE.

If posture state changes to Unknown your policy should be such that it pushes different authorization profile to endpoint and limits their access to only resources required to become compliant.

you can read more under "posture general setting" here