ISE 2.3 Temporal Agent - BYOD - check for Encryption

[ggriesse@cisco.com]

Hi all

I have a customer trying to meet a BYOD requirement by means of the new Temporal Agent

Minimal Acceptable posture requirement is (windows)

1)*Any*  AV Installed and Up to date

2) Disk encryption enabled ... again *Any* as long as its Encrypted ..

3) Various Microsoft Patch Levels..

We have sucesfully tested and Confirmed 1 and 3 BUT cannot work out a way to do the Disk Encry.. check

is this even possible , checking on the Posture rules i can not find an "any" for Disk Encry. only specifics and only on full AnyConnect agent not temporal ..

Ideas ?

Thx

Greg

[Jason Kunst]

I looked at the admin guide and it doesn’t say it’s unsupported , i have reached out to our SME imbashir

and mschmitz

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect45/administration/guide/b_AnyConnect_Administrator_Guide_4-5/configure-posture.html#reference_xry_4r5_l1b

[Jason Kunst · Accepted solution]

From imbashir Currently, ANY disk encryption is not supported, there are 2 use cases (both not supported in 2.3 and I don’t see then in 2.4)

1. Check if “ANY Disk Encryption” software is running, not supported today

2. Check if Any Disk is encrypted

Again, not supported but we have a workaround to create a file condition + disk encryption

in file condition, check if file (E:\NIL) exists, if exist, meaning there is disk E.

then create a disk encryption condition to check if disk E is encrypted.

[noel-armand]

hi

I have a customer requirement to use the ISE 2.3 Temporal Agent and posture check wired guests to ensure they are running 'any' AV. Does anyone know if this is supported, I'm guessing not? From a configuration point of view the Temporal Agent requires the compliance module as 4.x and above however the AV rules are constructed from compliance module 3.x

[howon]

Use Anti-Malware instead. Compliance module 4.x uses the term Anti-Malware which includes both Anti-Virus & Anti-Spyware.