I want to group VPN users and apply Posture differently.

[JustTakeTheFirstStep]

I have a question and would like an answer.

I am using ASA5525 - ISE2.6.

I am preparing to use the Posture feature in the ASA - ISE environment.

I want to group VPN users and apply Posture differently.

I think it identity group in the ISE Posture policy menu.

However, why does the "Posture system scan" proceed when the User "ns3793" is the "test" group in the ISE user identity and the identity group specified in the Posture policy is "B_group"?

I am wondering why the Posture System Scan is proceeding when I try to connect Anyconnect though the groups are different.

[howon · Accepted solution]

Looks to be defect from your description. Suggest contacting TAC.

Aside from the user group, are there any other attribute you can use? Are the users in different tunnel group? If so you could try custom condition such as 'Cisco-VPN3000:CVPN/ASA/PIX7x-Tunnel-Group-Name(146)'.