[Cisco ISE] Posture Status Unknown but AnyConnect as Compliant

[LKL4]

Hello team,

We are deploying Posture with Cisco ISE 2.7 (Patch7) and we are facing a strange issue. The machine with AnyConnect report to us the "Compliant" status with Network Access Allowed, but looking through ISE dashboard we receive "Unknown" status and the redirect for the provisioning portal.

- I've already disabled all posture rules, we're not scanning for anything (just software and hardware inventory).

- The CoA is correctly applied in the controller.

- We are using EAP-TLS (machine cert.) for auth..

- The WLC acl works good, redirecting 443, 8443, 8905 and allowing domain.

- The firewall are with any any allowed.

- The Authz. profiles (deny, permit and redirect for provisioning portal looks good too).

- We don't have any kind of posture on the wired network yet.

- Cisco ISE are with 'default posture status' setting as compliant

- Attached are the authz. policy (PNG).

Has anyone experienced something like this?

Thanks!

[hslai]

Please check whether the authentication, accounting, and posturing all done on the same ISE PSN node. Likely you need engage TAC to troubleshoot further.

[LKL4]

Hello @jhsl,

We are running ise with just one node (standalone) and TAC already involved in this analysis.

[LKL4 · Accepted solution]

Just adding the solution for my issue:
This is the new bug matching this behavior: CSCwa99904 17.6.2 || 9800 WLC Deletes Client when DHCP RELEASE is sent by client during Posture.

[LC.IT]

@LKL4 did the workaround fix the problem described on CSCwa99904?

[LKL4]

Hello @LC.IT 

Yes, in my case we were able to work around this by setting PMF to disabled (moved from WPA2+WPA3 to WPA+WPA2).

[LC.IT]

Great! I appreciate your reply.