topic Re: Posture required manually scan from user in Network Access Control

Posture required manually scan from user

oumodom — Mon, 02 Dec 2024 06:16:24 GMT

Dear Cisco ISE lover,

I would like to share current issue whether bug or expected result, as I test in lab for posture scan condition on Wired LAN and it required user to manually click "Scan Again" button to validate trusted device into authorization.

As our objective to automatically scan posture without human interaction, once the user plug in LAN and faster authorization (Permit any).

Cisco ISE v3.1
ISE Posture/Secure Client 5.1.2.42
Compliant module 4.3.3335.6146

Thank you,

Re: Posture required manually scan from user

ahollifield — Mon, 02 Dec 2024 13:00:08 GMT

Why ISE 3.1 and not 3.3 or 3.4?

Sounds like CoA is not working. What is the NAD?

Re: Posture required manually scan from user

oumodom — Tue, 03 Dec 2024 03:54:06 GMT

You are right, But we found 3.3 and 3.4 are most bug.
How to check CoA is working fine @ahollifield ?

Re: Posture required manually scan from user

Ambuj M — Tue, 03 Dec 2024 04:32:20 GMT

share your switch AAA config config where users connect.

As recommended, this will help verify if COA is enabled.

Re: Posture required manually scan from user

oumodom — Tue, 03 Dec 2024 07:13:21 GMT

Thank @Ambuj M

As remember, for Posture v4.9 it was doing well. But I can't confirm that v5.1 is bug existing or not.
If you have more experience, please kindly another approach to check.

Thank so much @Ambuj M

Re: Posture required manually scan from user

ahollifield — Tue, 03 Dec 2024 13:06:50 GMT

In the Live Logs you will dynamic authorization log messages. These will be either pass or fail.

Re: Posture required manually scan from user

ahollifield — Tue, 03 Dec 2024 13:07:18 GMT

https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/anyconnect-secure-mobility-client-v4x-eol.html

Re: Posture required manually scan from user

oumodom — Thu, 05 Dec 2024 01:43:09 GMT

Could you elaborate than this please?

Re: Posture required manually scan from user

ahollifield — Thu, 05 Dec 2024 13:15:26 GMT

What do you mean? Open the Live Logs page, filter on a specific Endpoint ID (MAC Address). You see both authc/authz messages and CoA logs here.