Automatic Antivirus Remediation in Posture

[adityaM1234]

Hi All,

I have configured ISE (1.2) to check Antivirus Installation on endpoints and it is working flawlessly.

Now, the client wants,

1) If Antivirus is not updated on endpoint for more than 5 days; it should be considered as "non-compliant" and as a remediation action; updates should be downloaded automatically.

--> I configured AV Remediation action.

Now, the problem is when endpoint gets categorized as non-compliant, ideally AV updates should get downloaded on endpoint as a remediation action. But AV updates are not getting downloaded.

Please help me in solving this problem..

Thanks in advance,

Aditya

[mohanak]

Adding an Antivirus Remediation

You can create an antivirus remediation, which updates clients with up-to-date file definitions for compliance after remediation.

The AV Remediations page displays all the antivirus remediations along with their name and description and their modes of remediation.

---

Step 1 Choose Policy > Policy Elements > Results > Posture.

Step 2 Click Remediation Actions.

Step 3 Click AV Remediation.

Step 4 Click Add.

Step 5 Modify the values in the New AV Remediation page.

Step 6 Click Submit.

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_pos_pol.html#pgfId-1924006

Antivirus Remediation

The following table describes the fields in the AV Remediation page. The navigation path is Policy > Policy Elements > Results > Posture > Remediation Actions > AV Remediation.

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_ui_reference_policy.html#23739

Table C-23 Antivirus Remediation

Fields	Usage Guidelines
Name	Enter a name for the antivirus remediation.
Description	Enter a description for the antivirus remediation.
Remediation Type	Choose one of the following: Automatic —When selected, you should enter values for the Interval and Retry Count. Manual —When selected, Retry Count and Interval fields are not editable.
Interval (in seconds)	Enter the time interval in seconds that clients can try to remediate after previous attempts.
Retry Count	Enter the number of attempts that clients can try to update an antivirus definition.
Operating System	Choose one of the following: Windows Macintosh —when selected Remediation Type, Interval, and Retry Count fields are not editable
AV Vendor Name	Choose the antivirus vendor.

[adityaM1234]

Hi mohanak,

Thank you for reply.

I configured the remediation action in ISE.

When the endpoint is categorized as non-complaint; as a remediation action antivirus should be automatically updated (updates should be fetched from internet automatically)

But at present antivirus is not getting updated, and as soon as remediation timer expires, endpoint's  network access gets blocked and it remains in non-compliant state.

Do we need to open any specific ip/url (eg.http://symantic.com/update) in the ACL on wlc in order to allow updates from internet ?

Regards,

Aditya

[andre.ortega]

Yes. You should put on your remediation ACL the IP/Port of antivirus server.

It will allow the antivirus client to access and to download the update.

Regards.