I have a few questions for implementing device health features.
The current test configuration is as follows.
asa vpn(secure client) - ise(3.3) - duo cloud(native mfa)
When connecting to the vpn, 2fa authentication was completed through duo mobile.
-> Cisco ISE Auth API was implemented
The next test goal is to use the device health function to control access based on whether the security agent is installed.
I have installed the duo desktop, but I am having difficulty finding the device registration and authentication procedure.
I looked up the guide and it seems that I can apply the universal prompt to the secure client application..
The way I want is that when I try to connect to the vpn client (the username/password account information is held by the ise server and duo cloud), a universal prompt window appears and I want to connect after the final 2fa authentication through duo push.
During this process, access control operation also occurs based on whether the Windows Defender Security agent is installed.
There is also talk that SAML IDP communication between ISE and DUO is required, but there doesn't seem to be a detailed guide. I feel like I'm missing something, so maybe you could correct me.
Can someone give me some advice or clarification on this?
