ISE 2.0 Integration with SCCM Patch Remediation

[Rss]

Hi

I did a patch management condition to check the SCCM 5.X was "UptoDate", and a patch management remediation action to "Install missing patches" (the same SCCM 5.X).

The posture result is compliant, but I dont know exactly what is checking or comparing, becuase I delete some critical patches and the ISE did nothing.

Does anyone knows what could be wrong or some documentation to see the procedure to make this work?

I have ISE 2.0 and SCCM 5.X

Thanks for your help

[nspasov]

Have you checked the Admin Guide for ISE 2.0? Take a look at the link below that will take you to the explanation on how to create a Patch Management posture remediation condition:

http://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/b_ise_admin_guide_20_chapter_010110.html#task_DBFD37F536134843BC81C4DFEF34A8EC

Thank you for rating helpful posts!

[Rss]

Thanks for your reply

Yes, I read the guide, but there is no much detail about what is comparing to, for example there are patch critical, optional, etc.

I dont know how the ISE check the installed patch and what are missing. (the only option is up to date)

Is there a way to do that?

Thanks

[nspasov]

Sorry that is the only info that I have and I don't have SCCM to test this. Perhaps someone else can chime in here or better, you can test it and let us know what the results are :)

[sadashivpalde]

Hello All,

I did a patch management condition in ISE2.0 to check the SCCM 5.X Installed, Enabled and UptoDate on a endpoint. but in Posture check report, I am observing this condition as Skipped instead of Pass or Fail. But if I am using application condition for SCCM, then its working fine.

Can anyone suggest??

[Ben.Levin]

We just finished setting up ISE 2.0 in our lab and have the same requirement since we're getting ready to deploy ISE in production.  We want to make sure clients have up to date patches before we give them full network access.  However, the documentation doesn't say anything about how this process works.  We really need to understand it before we can properly test.  We're reaching out to our Cisco contacts to try to get more info.