Please follow the following instructions for a workaround:
1. Add all PSNs to the call-home list in the "iseposture" Client Provisioning resource.
2. Create DACLs with only 1 PSN any/any and DNS any/any
3. Create separate Auth. Profile results that with DACLs for that PSN.
4. Create Authorization policies with the following:
(PSN used is A) AND (customers conditions) AND (Endpoint-not compliant) THEN Authorization Profile A
We have followed the steps to workaround the issue and have some more questions about how to handle redirection for a non-compliant device. It's our understanding (and our experience) that redirection can't be done on a downloadable ACL (dACL), so we need to figure out our non-compliant flow now that it has changed.
