Exclude mobile devices for posturing - Cisco ISE 2.3 patch 6

[networkteam@iima.ac.in]

Dear Community,

We are running Cisco ISE 2.3 patch 6 and we are facing issues in posture policy.

I have created 4 policies for posturing in following sequence. I have attached screenshot.

1. Mobile devices ( to exclude mobile devices for posturing )

2. Unknown redirect for client provisioning portal

3. Posture-compliant

4. Posture-Non-compliant

In Windows and MAC OS it is working fine but issue is mobile devices also hits policy no. 2 first and mobile devices get client providing portal after connecting to SSID and after in mobile devices click on start it hits policy no.1 and connects to the network.

I want to exclude mobile devices.

Please help.

Thanks,

AS

[Mike.Cifelli]

Can you share your client provisioning policies? You should be able to utilize operating system and/or other conditions to exclude the mobile devices as you wish.

[networkteam@iima.ac.in]

Dear Mike,

Thanks for your update but we tried that but sometimes it detects correct device and sometime not.

[hslai · Accepted solution]

This is expected.

Initially, the mobile devices are unknown (not profiled properly yet) so got redirected to ISE client provisioning portal and presented with with a "Start" button. Upon clicking on that "Start" button, ISE evaluates the client operating system info, and matches on the mobile OS. At this stage, the default posture status (configured at ISE admin web UI > Administration > System > Settings > Posture > General Settings) will apply and trigger a CoA re-authentication.

[networkteam@iima.ac.in]

Dear hslai,

Is there any way to this?