topic Re: Cisco ISE posture policy match orders in Network Access Control

Cisco ISE posture policy match orders

cheng.cathy — Thu, 10 Jul 2025 04:11:28 GMT

When defining a posture policy, if we have 3 separate policies with the same conditions {id group, operating system, other conditions}, one with requirements for AV and one is Anti-spyware and another one is Anti-Malware.

It doesn't have to meet all these three polices to be marked as compliant. The client will be marked as compliant if any of this policies does meet. is it correct?

Re: Cisco ISE posture policy match orders

robertwilkinson1 — Thu, 17 Jul 2025 13:16:08 GMT

I am just getting started in the posture world so I might be off, but it depends on how you have your policy set if audit, optional or mandatory. If its audit or optional it will still mark as compliant even if not. If set to mandatory, if it fails any of those conditions it will be marked as non-compliant.

Re: Cisco ISE posture policy match orders

MHM Cisco World — Wed, 23 Jul 2025 13:06:26 GMT

more info will share
update soon

MHM

Re: Cisco ISE posture policy match orders

robertwilkinson1 — Thu, 17 Jul 2025 14:42:17 GMT

The way I understood their question is more on the posture policy config versus the policy set for mab/dot1x side where the authz rules are used. Posture has it's own policy set to follow for that function

Re: Cisco ISE posture policy match orders

MHM Cisco World — Wed, 23 Jul 2025 13:07:07 GMT

more info update soon
thanks

MHM

Re: Cisco ISE posture policy match orders

MHM Cisco World — Thu, 24 Jul 2025 09:01:44 GMT

@cheng.cathy

It doesn't have to meet all these three polices to be marked as compliant. The client will be marked as compliant if any of this policies does meet. is it correct?

Correct' ISE will check policy from top to down' first policy all conditions is meet is check other is skip

MHM

Re: Cisco ISE posture policy match orders

elvera33ford — Thu, 24 Jul 2025 12:17:14 GMT

No, that is not correct. If you have three separate posture policies with identical conditions (ID group, operating system, other conditions) but distinct requirements (AV, Anti-spyware, Anti-Malware), a client must typically satisfy all applicable policies to be marked as compliant. Posture policies are generally evaluated conjunctively, meaning all defined conditions and requirements within the scope of the client must be met for overall compliance, unless the policy system explicitly offers an "OR" logical grouping option for requirements, which is not the standard behavior for independent policies.