Is VPN and DNS server essential in posture process

[jinyuanbao]

Hi guys,

I'm using mab as authentication method to fulfill posture,

 and in win10 successfully redirect to the cpp webpage, 

then i download the package and open it

then it failed in this step, says couldn't connect to the server

So why it failed in this step, 

I've read some configuration example documents, and nearly all of them list cisco asa vpn as a requirement, i don't have asa, and don't understand why vpn is a must.

And i figured maybe it's the DNS issue, i don't deploy DNS server in my environment, the pc can't resolve some domain names and can't procceed further, so is DNS server a must, can i just set somewhere to let endpoints just fetch resources from the ise's ip address.

Thanks in advance!!

[Kasun Bandara]

ASA VPN is not must. Error says, your client PC cannot connect to ISE server. you need to deploy small DNS server and configure it to resolve ISE server domain name to client PC.

[Marcelo Morais]

Hi @jinyuanbao ,

the Cisco AnyConnect deployment option are:
 - Predeployment (manually or via an SMS/SCCM)
 - Web Deployment (via a Headend: FTD, ASA or ISE 2.0+)

In your case you need the AnyConnect ISE Posture, check the Authorization Profiles (at Work Centers > Posture > Policy Elements > Authorization Profiles) for your Authorization Policy called Unknown-Compliance, double check your ACL configuration (at ... Authorization Profiles > Common Tasks > Web Redirection).

Hope this helps !!!

[Charlie Moreton]

DNS is a MUST in ISE deployments, including reverse lookups (PTR records).  You also need to configure the Posture profile with the names (or IP Addresses) of your ISE PSNs.  

AnyConnect is used as the agent (as shown in your screenshots) and the ISE Posture Module for AnyConnect is used to assess (and remediate) the posture of your device.  

SO,

1. DNS is needed

2. VPN is not needed, but AnyConnect does a LOT more than VPN