Need to configure grace period of 8 hr to non compliance endpoints,so that non compliance endpoint's user get time to make his/her system compliant as per the company policy.
-Will these non-compliant machines require full network access in that 8 hour window? Why not consider setting the remediation timer longer (can be up to 5 hours) in the posture global settings? In this window the client is neither compliant nor non-compliant yet. Essentially it is still deemed unknown since the scan would still be going, and the "non-compliant" machines would be stuck on a missing check. In this AnyConnect unknown state you could have a dacl limiting network access, but grant the ability to reach resources that would allow your clients a window to patch/remediate to become compliant. Then if clients are unable to get compliant within the remediation allowed window, they then move into a Non-compliant state, which limits network access and at this point is deemed non-compliant per policy assessment (sitting in a quarantine restricted state). Note that you have the ability to push a 'Scan Again' button feature via the ISEPostureCFG.xml that would allow end users to initiate the module probe to ISE. This could allow a true non-compliant client/user the ability to initiate a re-scan without the need of a DFG change, or some other action to initiate the probe.
how to configure grace period ?
-See here: ISE Posture Prescriptive Deployment Guide - Cisco Community
What is the best practice ?
-IMO this depends on your requirements and will vary per use case.
maximum how much time we can set the notification for grace period ?
-You can configure the grace period in minutes, hours, or days (up to a maximum of 30 days). It is important to know that an endpoint is only able to utilize a grace period if they were previously deemed compliant.
HTH!
