topic Re: ISE posture issues in Network Access Control

ISE posture issues

svatnaum — Wed, 10 Sep 2025 09:21:11 GMT

Dears

We have DNA Fabric environment with Cisco 9800 WLC and ISE 3.2 integrated with it, endpoints Windows and MAC OS are using Anyconnect Client posture module (version 5.1.10.233) , on our network we have Quarantine subnet and Production subnets for each department, when user connects to the network it first landing on Quarantine subnet if Cisco Anyconnect posture module compliance check is successfull user should be redirected to its production subnet

Issue is that sometimes on some random endpoints it happens that posture says its compliant, but user stays in Quarantine subnet, on Windows machines we can see "Action Required" on Wireless SSID and when you press it, its redirects to the ISE client provision portal and says that user doesnt have Anyconnect client installed, however it is installed, its like ISE cannot detect that Anyconnect client is installed sometimes, on MAC OS it just stucks in Quarantine, if we restart Windows Machine or MAC OS it can connect properly, but this is a problem as we have around couple of thousand users

On Wired device this never happens, only on Wireless, we suspecting it might be related to sensitive timers on WLC or Posture agent profile timers, but we are not sure

Same happened on older version of Anyconnect client

Agent posture profile timers are similar for MAC and Windows, I've attached screenshots

Also to note, if we disable posture compliance check on our user Authorization policies, users are not experiencing such problems, its like if we enable posture compliance check it might take more time and user stucks somewhere in the process

Also, we have Palo Alto Global Protect on all endpoints, which used mostly for VPN from remote location, but at the same time it is enforcing local network policies when user is on local company network, Global protect has all required IP's whitelisted

Please let me know if you faced such and if you need any more details

Re: ISE posture issues

ahollifield — Wed, 10 Sep 2025 19:59:31 GMT

This 100% sounds like a CoA failure. Do you have CoA properly configured on the WLC and on ISE? Do you see any CoA failed Live Logs? Why all of the overhead of switching VLANs at all? Why not use a dACL or SGT for pre/post posture states?

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-1-3-2.html

Re: ISE posture issues

svatnaum — Thu, 11 Sep 2025 05:14:15 GMT

Hello,

We have CoA configured on ISE and WLC (screenshot attached), issue happens randomly, sometimes we can see failed live logs with "EAP timeout" and it seems it happens because we have 2 ISE nodes working active/active, we configured our NAD devices to send messages in load balance way, if one ISE gets that message it responding to the client. while second one waiting for the client reply, but it never happens so we getting this failure live logs

We tried to use dACL but we got some problems with user aaa, we have redirection ACL's working on WLC's itself

Re: ISE posture issues

ahollifield — Thu, 11 Sep 2025 09:54:03 GMT

What do you mean “in a load balance way?” Using the native IOS-XE command? That’s not how that command works if so. Or do you have an external load balance in front of ISE?

What exact issues did you have with a dACL?

Re: ISE posture issues

svatnaum — Thu, 11 Sep 2025 10:55:39 GMT

Yes using IOS native commands under the radius server groups, can you please let us know what do you mean under it doesnt work like that?

We had same problem with dACL

Re: ISE posture issues

ahollifield — Thu, 11 Sep 2025 11:19:03 GMT

Right the WLC picks a PSN to send a single transaction to. It doesn’t send to both or round robin within the same session.

Do you have something blocking UDP/1700? Do you have any dynamic authorization failed alarms? What version of ISE? What version of IOS-XE? Is your ISE deployment properly sized? DACL in this flow is also dependent on working CoA.

Re: ISE posture issues

svatnaum — Thu, 11 Sep 2025 11:44:42 GMT

Yes WLC picks a PSN, depends on request from the endpoint, I can see there is different transactions to different PSN's

We've checked 1700 its open all the way to the PSN (Firewall in the middle allowing it), no CoA alarms observed, 3.2.0.542, patch 2,7, IOS XE WLC Version 17.9.4a, ISE model is 3615, we have around ~ 4k concurrent sessions/active endpoints

Just to mention - we have Global Protect from Palo Alto working as VPN client for remote VPN, but it second function is local network policy enforcement, it auto detects if user is on LAN and allows access to the whitelisted IP, we thinking there might be a conflict between them regarding timers, cause first Global Protect need to be in "Connected" state in order to allow connections for ISE Posture, if there is any way to delay Posture scanning process it might help us

Re: ISE posture issues

ahollifield — Thu, 11 Sep 2025 12:08:03 GMT

Yes the Global Protect could easily be causing this issue as well if it’s blocking Secure Client from performing posture. Why are you using both ISE and GlobalProtect? I wouldn’t try to mix both as running multiple posture agents (one which includes blocking connections) is going to be problematic. I would pick either ISE Posture or GlobalProtect posture, not both.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-1-3-2.html

https://cs.co/ise-scale

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/secure-network-server-3615-3655-3695-eol.html

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-17/ios-xe-17-9-x-eol.html

Re: ISE posture issues

svatnaum — Thu, 11 Sep 2025 14:00:12 GMT

Thing is that GlobalProtect indeed has its own posture, but we are not using it (its called HIP), posture function done only on Cisco Anyconnect, I wonder if there any best practices regarding ISE Posture General settings timers (remediation, network transition and other timers) for the possible slowness in Wireless environment or if its possible to use timers to wait for Global Protect to be in "connected" state, same question for the settings in Agent Posture Profile timers in "IP address Change" menu (VLAN detection interval , ping or ARP, maximum timeout for ping, DHCP renew/release delay, Network Transition delay timers), might be that fixing this timers and aligning this to our "slow" Wireless environment might help

Re: ISE posture issues

MHM Cisco World — Thu, 11 Sep 2025 15:08:11 GMT

User which failed can I see log live detail of ise for it ?

MHM

Re: ISE posture issues

svatnaum — Fri, 12 Sep 2025 09:02:38 GMT

Hi,

I think we are hitting https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html

Same symptoms

Re: ISE posture issues

svatnaum — Fri, 12 Sep 2025 09:02:58 GMT

I think we are hitting https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html

Same symptoms

Re: ISE posture issues

MHM Cisco World — Fri, 12 Sep 2025 12:27:14 GMT

Sure Yes'

Multi PSN without sync can lead to pending posture.

I always recommend for such case by use single PSN in wlc and check.

MHM

Re: ISE posture issues

svatnaum — Fri, 12 Sep 2025 12:50:43 GMT

If I will just keep both radius on WLC and remove load balancing method, I think it will send traffic to the first radius anyway? second one will work only if first radius goes down

Re: ISE posture issues

MHM Cisco World — Fri, 12 Sep 2025 13:02:39 GMT

Good idea

You will get redundacy only (no load balance).

MHM

Re: ISE posture issues

svatnaum — Mon, 15 Sep 2025 06:27:44 GMT

Seems, its working so far, no issues after we disabled load balancing on WLC IOS XE level, will update you

Re: ISE posture issues

MHM Cisco World — Mon, 15 Sep 2025 07:07:25 GMT

I am so sure it will be OK

MHM

Re: ISE posture issues

svatnaum — Tue, 16 Sep 2025 07:12:19 GMT

Its seems we still see some issues especially on MAC OS, people stuck in quarantine subnet and dynamic change of IP never happens, Im thinking cause we have Global Protect VPN client from Palo Alto, it sometimes doesnt allow CoA message to be delivered from WLC to the client in quarantine subnet to make IP change with CoA