ISE 2.0 Posture check audit mode skipped checks

[sdoherty]

When using AnyConnect VPN 4.0 via ASA 9.2 to posture check a client not all checks are completed.  When one fails the rest are skipped.  It would be nice to check to see all the issues with the client vs finding one issue and fixing it then having to re-posture to find the next.

[nspasov]

There isn't an option to pick "AND/OR" operator when selecting the posture requirements. However, you can make the posture requirements "optional" or put them in "audit" mode. 

"Optional" mode is probably what you are looking for. For instance, you can make 3 out of 4 requirements optional and set one requirement as mandatory.

I hope this helps!

Thank you for rating helpful posts!

[sdoherty]

Thank you Neno,

Actually the posture requirement conditions are set to audit and there are many conditions..  For example we are checking for a registry key, a file existence, a service, and ps AV condition.  When one of these conditions fails then the others are 'skipped'.  

This shows in the operations/reports/endpoints and users/posture assessment by endpoint.

The idea is that you would want to see the complete posture results and not have the posture check abort when there is a failure of one of the items.

Thank you

[nspasov]

Have you tried to set them all as "optional" and see if that gets you the desired result?

Thank you for rating helpful posts!

[sdoherty]

Neno,

I have tested this also - Enforcement = Optional..  The firewall check passed, the file existence check failed, and the last 3 checks were skipped.

I tested this when they all passed and it checks them all.

To simulate the failure I changed the file check to search for a file that is not there.

Thank you

[nspasov]

Sorry but I have no other suggestions/ideas...perhaps a call to TAC would be useful. 

Thank you for rating helpful posts!

[sdoherty]

Thanks Neno,

It seems ISE will check each requirement if they are stacked in the Posture Policy. So the logic is to add a Posture Policy rule for each requirement and it will work.  I have about 17 posture rules so I make the Posture Conditions first then the requirements as the backend and then the Posture Policy to point to them.

Thank you!