topic Hi DennisI got a similar in Network Access Control

Cisco ISE (1.3) Posture without Client Provisioning

dennisnieuwenhuyzen — Mon, 11 Mar 2019 05:34:30 GMT

Hello readers,

Is it possible to set up Cisco ISE with posture without Client Provisioning?

My customer deploys the NAC Agent via MS SCCM. We prefer a access accept + DACL during the pending state instead of redirecting to client provisioning. But the NAC Agent will only communicate when we redirect to client provisioning.

Regards,

Dennis

Hi DennisI got a similar

Gaj Ana — Thu, 08 Oct 2015 06:01:13 GMT

Hi Dennis

I got a similar scenario. Were you able to find a solution?

Thanks

The NAC agent needs to be

jan.nielsen — Thu, 08 Oct 2015 17:00:39 GMT

The NAC agent needs to be redirected to find the PSN node that is servicing the session that was created when the switch/wlc tried to authenticate the user/machine, this is why you can't hardcode an ise server into the nac agent. However if you configure a discovery host in your nac client, then that is the only ip address you need to create a redirect for in your acl, everything else can be allowed. So just pick an unused ip address thats routeable, and use that as discovery host, then make sure that you redirect to provisioning when the agent makes it's http request on port 80 to that ip.

Hi JanThanks for the feedback

Gaj Ana — Thu, 08 Oct 2015 23:28:12 GMT

Hi Jan

Thanks for the feedback.

If we don't use the discovery host and in the case of pre-deployed agent just wondering how does the agent will try to discover a PSN . Assuming there can be more than one PSN's in a distributed setup and since the browser method is not used no session is created initially and agent is unaware which PSN to connect to?

Thanks

The Agent will run through

jan.nielsen — Thu, 08 Oct 2015 23:36:27 GMT

The Agent will run through different probes to detect the redirect with the session in the url, to find the psn. If there is no redirect, it will never find the psn, this is required to make it work. This is a good guide for technical info on the swiss protocol : http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/118724-technote-ise-00.html#anc2

I indeed solved it without

dennisnieuwenhuyzen — Fri, 09 Oct 2015 05:22:48 GMT

I indeed solved it without hardcoding the ISE server in the NAC-agent. The problem we had was that when not using GigE0 Cisco ISE returned a IP-adres of the interface instead of a hostname. We resolved this using the ip host command on the PSN cli.

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/cli_ref_guide/ise_cli/ise_cli_app_a.html#pgfId-2567879

Thanks Dennis

Gaj Ana — Fri, 09 Oct 2015 12:10:36 GMT

Thanks Dennis

Thanks Jan

Gaj Ana — Fri, 09 Oct 2015 12:11:34 GMT

Thanks Jan