Cisco ISE Posture Check only for remote vpn users

[cheng.cathy]

\How to set up the posture policy to do check only for remote vpn(Cisco secure client) users, no posture check for users connected via wired or wifi?

Thanks

[MHM Cisco World]

try use in posture policy  condition NAD IP which is FW IP 
MHM

[MHM Cisco World]

Policy > Policy Elements > Posture > Posture Policy

Condition 

NAS-IP-address (FW IP)

MHM

[Rob Ingram]

@cheng.cathy you just need to add a condition in your ISE Authorisation rules to match RAVPN sessions and not Wired/Wireless connections. Add a condition for Remote Access VPN users such as NAD IP address of the ASA/FTD or NAD group or Tunnel Group name and then assign the Posture Authorisation Profile to ensure posture runs. Example using tunnel group name:-

For the Wired/Wireless user session, they would not match the the more specific rules for RAVPN and would match another rule, which does not run posture.

Reference webinar on RAVPN posture - https://community.cisco.com/t5/security-videos/community-live-7-9-cisco-ise-posture-over-remote-access-vpn/ba-p/5307501