Cisco ISE 1.3 Posture Issue.

[Jay233]

Hi All,

Quick question: For ISE client posture assessment how do you configure ISE to use multiple AV vendors?

Example: I have configured ISE client posture assessment for Sophos AV definitions which works ok, if I introduce another AV vendor for posture assessment the client doesn't pass compliancy because it tries both AV vendors? How do you ensure ISE checks and marks the client as compliant for either AV suite?

Clients are using AnyConnect V4.  

Thanks in advance for any replies.

[jan.nielsen]

You can use a compound posture condition, where you can use the OR statement, then you will be compliant as long as one of your conditions have been fulfilled.

[Jay233]

Hi Jan,

Any chance of an example please, compound posture condition?

So define the posture policy then > client provisioning policy > policy elements > conditions.

Thanks.

[jan.nielsen · Accepted solution]

Actually, after checking i don't think you can use two av compound conditions, in another compound condition, so you might have to create it by using both your conditions in the same requirements, and then select "Any of the conditions succeed", only problem is you can only have one remediation action, which can be an issue.

[Jay233]

Many thanks Jan, your support is really appreciated.

[jan.nielsen]

No problem, let us know if you this working.