AnyConnect NAM + RSA + Posture

[sampathss]

Hello,

One of my customer is using NAM + RSA(EAP Chaining) + Posture.

We tested and it was working like the following earlier:

1) User connects machine to the network

2) User enters username and passcode(RSA) in NAM

3) Posture starts and at 96%, CoA happens and once done, it prompts for passcode again and do the posture again, completes and compliant. I guess it's doing full auth and not silent re-auth

I believe this is the known behavior.

But recently, the behavior changed and the second time where it asks for passcode after CoA, now it asks for both username and passcode, then it does posture and compliant.

Any idea what might be triggering it to ask for the username again?

[kthiruve]

Hey Sampath,

What version of Anyconnect are you using and RSA version as well.

I have reached out SME for Anyconnect, Paul Carco to answer this.

Thanks

Krishnan

[sampathss]

Hey Krishnan,

AnyConnect Version is 4.4.04030. Reached out to the customer to find out about the RSA Version. Will let you know.

Thank you.

[sampathss]

Hey Krishnan,

RSA version is 7.3.3.103

Thanks

Sampath

[hslai · Accepted solution]

Anything in particular (NAM profile or versions of AnyConnect or RSA or ISE or NAD) changed recently? I would suggest to engage Cisco TAC and submit a copy of the DART file to TAC.

[sampathss]

Hi Hsing,

Nothing changed recently. I will engage TAC as well.

With respect to the endpoint behavior, the above mentioned steps(Step 1 to Step 3) sounds right?

Thanks

Sampath

[hslai]

The steps look fine. You are correct it expected because of OTP. ISE 2.3 has a passcode caching option that you might want to try.

[sampathss]

Hsing,

This is available in ISE 2.2. I already tried this and no help out of it.

I understand it asks for passcode the second time because of OTP, but why ask for the the username again? It was not the case earlier when tested and it use to prompt only for the passcode the second time. Could it be NAM not caching the username?

Thanks

Sampath

[sampathss]

Any update on this?