Cisco AnyConnect on-connect script trigger via ISE

[rashish135@yahoo.co.in]

Hi
We are using Cisco AnyConnect with posture check via Cisco ISE.

Now we want to run some Windows scripts for AnyConnect users post connecting VPN and completing posture check.

Please guide how we can configure ISE to triggers script with COA.

Regards

Ashish Shah

[balaji.bandi]

check the admin guide : ( are you looking for a community to provide the script  ? or guidance ?)

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/customize-localize-anyconnect.html

other references:

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html

[rashish135@yahoo.co.in]

Hi

Thanks for the reply. But this is not I am looking for. 

We have logon script and posture enabled. But when user login to AnyConnect script start running before posture check complete.

So we want to trigger the script from ISE during COA and i am looking for calling script in ISE.

Regards

Ashish Shah

[pavagupt · Accepted solution]

Hello Ashish Shah,
i am still unclear on "trigger the script from ISE during COA". However, i am giving the possibilities from ISE.
1. You can run scripts (on Windows, Powershell scripts can be used whereas on SHELL scripts on macOS) as part of remediation starting from ISE 3.1 onwards. You can refer to Posture Script Remediation for more details on this.
2. In upcoming release ISE 3.2 onwards, Administrator can run a script as a Posture condition to check against Windows, macOS and Linux (PowerShell, SHELL and SHELL respectively) OS along with existing native Posture AM/Process/registry/file..etc checks. Currently ISE 3.2 is running in beta version and you can refer more details about Posture script condition

3. The Endpoint Scripts Wizard in 3.0+ allows you to run scripts on connected endpoints to carry out administrative tasks that comply with your organization’s requirements. This includes tasks such as uninstalling obsolete software, starting or terminating processes or applications, and enabling or disabling specific services.