topic Re: Posture Unknown flow for endpoints without Posture agent Installed in Network Access Control

Posture Unknown flow for endpoints without Posture agent Installed

rezaalikhani — Thu, 10 Oct 2024 06:29:24 GMT

Hi all;

Consider the following Authorization Policy:

In this case, although I have configured the "Default Posture Status" setting as "Compliant", but as soon as an endpoint without posture agent installed connects to the network, it matches with the "Posture Unknown" condition and therefore, the limited dACLs applies to it.

Any ideas?

Thanks

Re: Posture Unknown flow for endpoints without Posture agent Installed

rezaalikhani — Tue, 15 Oct 2024 10:36:05 GMT

The desired VLAN includes both Windows 10 and Windows 7 machines and therefore, when a Windows 7 computer connects to the network, it always matches with the configured "Unknown" policy which has very limited network connectivity and unfortunately stucks in this stage (because of Windows 7 supportability for ISE Posture Module, the client cannot include this module installed. Right?). I want to bypass this policy for Windows 7 PCs without using Profiling Policy inclusion of just Windows 10 PCs.

The following is the fact from the client (with Windows 7) that ISE has gathered?

Any ideas?

Thanks

Re: Posture Unknown flow for endpoints without Posture agent Installed

Aref Alsouqi — Tue, 15 Oct 2024 10:46:26 GMT

How about selecting only Win 10 operating system in the posture assessment policy and conditions?

Re: Posture Unknown flow for endpoints without Posture agent Installed

rezaalikhani — Tue, 15 Oct 2024 11:34:01 GMT

Thanks for your reply;

This is my first possible solution but without success.

Re: Posture Unknown flow for endpoints without Posture agent Installed

Aref Alsouqi — Wed, 16 Oct 2024 09:51:53 GMT

If you could please share the screenshot of your posture assessment configuration for review.