did you ever get this figured out? we're having the same issue.
we have re authentication set for 3600 seconds at the authorization profile and then set the switchports for authentication periodic and to pull the timer from the server. user logs in, posturing completes and they are good for 3600 seconds. then the timer expires and the port goes back to pending but re-auth never happens. the redirect URL and the posturing ACL get reapplied to the port but the anyconnect agent never does anything and just sits there saying the endpoint is compliant. i've setup PRA on the anyconnect profile but that doesn't seem to be working either?
so anyconnect never responds and the ports just STAY in pending and the user is forced to disconnect or reboot to get things working again.
are posturing and re-auth mutually exclusive? what is suppposed to get the Anyconnect posturing agent to recheck the host and send to ISE?
