topic Re: Downloading the initial ISE Posture Profile in Network Security

Downloading the initial ISE Posture Profile

ChadH63728 — Fri, 21 Jul 2023 16:41:00 GMT

We currently have Anyconnect with the ISE Posture Module installed. We are using this to posture devices on our wired network before granting network access. Our computers already have the software installed but not the ISEPostureCFG.XML which has the call home list of our ISE servers. Is there a way to force the clients to download that profile when first connecting? Again this is for devices uses 802.1x on our internal wired network, not VPN. Thanks

Re: Downloading the initial ISE Posture Profile

Dustin Anderson — Fri, 21 Jul 2023 16:55:04 GMT

You should have an anyconnect config file you call, there you can set the posture config to use/download.

Re: Downloading the initial ISE Posture Profile

ChadH63728 — Fri, 21 Jul 2023 17:11:58 GMT

I did set this up but the policy doesn't download. The ISE Module just says no policy server detected. Then if I manually add the ISEPostureCFG.XML file it will then follow the config file rules (upgrade anyconnect version and update the profile)

I modified my example here. The real project I'm working on here is to allow a client to move from a network using one ISE server to another network with different ISE server. Without manually change the ISEPostureCFG.XML contiaining the different ISE call home servers the policy servers aren't detected.

Re: Downloading the initial ISE Posture Profile

Dustin Anderson — Fri, 21 Jul 2023 17:30:09 GMT

with the posture redirect that would trigger the install of AC or to force the check-in, but I'm not sure on not needing the config different for each.

Does each site have it's own DNS? where you could set up a similar name pointing to the respective servers?

Re: Downloading the initial ISE Posture Profile

ChadH63728 — Fri, 21 Jul 2023 17:40:36 GMT

Unfortunately it's the same DNS for both networks.

Re: Downloading the initial ISE Posture Profile

Dustin Anderson — Fri, 21 Jul 2023 17:52:55 GMT

can each site talk to the ise at the other? If they can't you should be able to list multiple posture servers and let AC talk to the one it can connect to.

Re: Downloading the initial ISE Posture Profile

ChadH63728 — Fri, 21 Jul 2023 17:57:42 GMT

Worth a try - thanks for the idea's.

Re: Downloading the initial ISE Posture Profile

Dustin Anderson — Fri, 21 Jul 2023 18:25:19 GMT

yeah, let me know, it's a different deployment and nothing I can test myself.