topic Re: Cisco ISE posture compliance issue was detected Carbonblack in Network Access Control

Cisco ISE posture compliance issue was detected Carbonblack

ShareefKooliyodan0444 — Tue, 21 Oct 2025 07:32:49 GMT

"A Cisco ISE posture compliance issue was detected after installing Carbon Black sensor version 4.1.0.5463 on a Windows 11 Pro system."

"Has anyone else encountered this issue? I'd appreciate any guidance on how to resolve it. Thank you!"

Re: Cisco ISE posture compliance issue was detected Carbonblack

Mark Elsen — Tue, 21 Oct 2025 08:37:33 GMT

- @ShareefKooliyodan0444 You need to lookup why the posture compliance test failed in ISE.
I no longer manage ISE; possible checks are :
Operations > Radius > Live logs
Operations > Radius > Live logs > Desired authentication > Live log
Operations > Reports > Endpoints and Users > Failure Reasons
Operations → Reports → Posture → Detailed Posture Report

Re: Cisco ISE posture compliance issue was detected Carbonblack

Mark Elsen — Tue, 21 Oct 2025 08:42:24 GMT

- @ShareefKooliyodan0444 Ref : https://www.cisco.com/c/en/us/td/docs/security/ise/ac_compliance_module/support-charts-for-cisco-secure-client-windows-compliance-module-v4-3-5062-8192.html

Product version Compliance module version

Carbon Black Sensor	6.x	yes	yes	-	4.3.5062.6145
Carbon Black Sensor	7.x	yes	yes	-	4.3.5062.6145

Check the above requirements too!

Re: Cisco ISE posture compliance issue was detected Carbonblack

ShareefKooliyodan0444 — Tue, 21 Oct 2025 09:36:58 GMT

Hi thank you for your replay ,

my AnyConnect version is 4.10.05085. do i need to upgrade ?

Re: Cisco ISE posture compliance issue was detected Carbonblack

Mark Elsen — Tue, 21 Oct 2025 09:51:50 GMT

@ShareefKooliyodan0444 This is not related to Anyconnect. What ISE version are you using ?

Re: Cisco ISE posture compliance issue was detected Carbonblack

ShareefKooliyodan0444 — Tue, 21 Oct 2025 10:28:35 GMT

My ISe version is

ISE Version: 3.1.0.518

Re: Cisco ISE posture compliance issue was detected Carbonblack

Mark Elsen — Tue, 21 Oct 2025 11:34:23 GMT

- @ShareefKooliyodan0444 Actually are you using Anyconnect ?

Re: Cisco ISE posture compliance issue was detected Carbonblack

ShareefKooliyodan0444 — Tue, 21 Oct 2025 12:43:47 GMT

Yes . my AnyConnect version is 4.10.05085.

Re: Cisco ISE posture compliance issue was detected Carbonblack

Mark Elsen — Tue, 21 Oct 2025 13:04:22 GMT

- @ShareefKooliyodan0444 Have a try with the latest : https://software.cisco.com/download/home/286330811/type/282364313/release/5.1.12.146
these days called Secure Client

Re: Cisco ISE posture compliance issue was detected Carbonblack

ShareefKooliyodan0444 — Thu, 23 Oct 2025 05:54:06 GMT

The issue remains unresolved. I haven't tested the new version yet, but I'm planning to switch.
Before proceeding, I’d like to confirm: if I update AnyConnect to Secure Client, will it cause any disruption or impact to live operational endpoints?

Re: Cisco ISE posture compliance issue was detected Carbonblack

Mark Elsen — Thu, 23 Oct 2025 07:11:08 GMT

@ShareefKooliyodan0444 It' won't

Re: Cisco ISE posture compliance issue was detected Carbonblack

IFS — Tue, 18 Nov 2025 20:34:45 GMT

We are not using ISE, but we are using the Cisco Secure Client for VPN access. We use the Dynamic Access Policy (DAP) to assess the posture of our endpoints before they connect and inspect for things like an authorized certificate as well as the installation of the Carbon Black Cloud Sensor.

We were using Secure Client 5.1.12.146 and updated from the Carbon Black Cloud Sensor 4.0.3.2029 to 4.1.0.5463. The debug logs during a client authentication attempt to the VPN revealed that after the Carbon Black update, the Carbon Black sensor was no longer being detected. Not even the version number.

We updated the Secure Client to version 5.1.13.177, including the Posture module that is supposed to contain updates to the OPSWAT that I believe is used to identify attributes of the client such as the Carbon Black Cloud Sensor and it's version number, but that did not resolve the issue for us. For now, we had to remove the Carbon Black Cloud Sensor requirement from the DAP policy.

I suspect this will get resolved in the next version of the Cisco Secure Client, and I've opened a TAC case to help move the process along. I hope this info is helpful.