topic Re: ISE Posture - Automatic Redirection to Client Provisioning Portal in Network Access Control

ISE Posture - Automatic Redirection to Client Provisioning Portal

Danny Dulin — Thu, 17 Apr 2025 13:11:05 GMT

When I connect to my VPN headend (FTD 7.2.9) I make it through authentication and authorization. ISE recognizes my host as "Posture Unknown", but no browser pops-up automatically with the Client Provisioning Portal. If I open a browser and navigate to an http site, redirection works.

The redirect ACL name is exactly the same on the FTD and in the ISE Authorization Policy.

The redirection ACL denies DNS, DHCP and ISE from redirection and permits all else.

Packet capture shows host never attempts to access an http site over my VPN tunnel, which I suppose is the reason the automatic redirect doesn't work.

I have seen more than one video that demonstrates the browser automatically launching after the VPN connection is established.

Any help will be greatly appreciated.

Re: ISE Posture - Automatic Redirection to Client Provisioning Portal

smilic — Fri, 29 Aug 2025 07:02:50 GMT

I used OnConnect script (need to be enabled in anyconnect profile to work) that opens http://enroll.cisco.com, IP 72.163.1.80 is configured in split tunnel ACL, and redirect ACL catches it. But, I used this only for external partners & temporary agent. For employees it's better if you preprovision ISEPosture.cfg file and ISE posture agent, and configure ISE hosts in cfg file, then posture client knows where are ISE hosts and can connect to them without browser redirection.

Re: ISE Posture - Automatic Redirection to Client Provisioning Portal

ahollifield — Wed, 03 Sep 2025 12:05:18 GMT

Have you looked at redirectionless posture instead? Also why 7.2.9 and not something newer?

Re: ISE Posture - Automatic Redirection to Client Provisioning Portal

Danny Dulin — Wed, 03 Sep 2025 12:37:19 GMT

No I haven't looked at redirectionless posture.

7.2.9 because we still have Firepower 4110's that are incompatible with anything above 7.2. Moving away from these in the future.

Re: ISE Posture - Automatic Redirection to Client Provisioning Portal

ahollifield — Wed, 03 Sep 2025 12:51:27 GMT

Got it, I would highly recommend looking at redirectionless posture instead. It's a much better user experience.

https://www.cisco.com/c/en/us/products/collateral/security/firepower-ngfw/firepower-4110-series-security-appliances-eol.html

Re: ISE Posture - Automatic Redirection to Client Provisioning Portal

MHM Cisco World — Wed, 03 Sep 2025 12:55:21 GMT

check posture in client side

MHM