cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

685
Views
0
Helpful
6
Replies
David Milne
Beginner

ISE 2.3 BYOD with Temporal Agent - Odd Behaviour

Hi Folks,

 

Working on a POC/Test ISE deployment prior to the full production rollout and I'm encountering some odd behavior with my wireless BYOD setup. I'm seeing the following issues on my test machine, and it seems to happen every time I test. 

  1. BYOD clients lose posture status every time they log off/reboot (or perhaps more accurately, when they reconnect to the corproate SSID), but posture lease is set to 14 days and there is no periodic re-assessment configured. My understanding is that the posture lease should apply to all clients, but I may be mistaken there?
  2. When BYOD clients are posture-assessed using the temporal agent, the first run through doesn't update the posture status in ISE - I need to be redirected a second time, run the temporal agent a second time and then I get full network access.

I have a feeling it may be related to my configuration (specifically the client provisioning/posture setup), but was curious if anyone had any thoughts on those issues? I'm going to try and get some screenshots later to illustrate my client provisioning policy setup, just in case it's something there - I've got separate lines for posture and provisioning as it was the cleanest way I could think to configure it, but there's probably a better way. I'm pretty new to ISE!

 

Thanks!

2 ACCEPTED SOLUTIONS

Accepted Solutions

Temporal Agents doesn't get installed on the clients. So temp agent cannot perform posture lease, clients need to download and run temporal agent every time to perform posture check.

 

The solution is to use Anyconnect Agent.

View solution in original post

No there is not. If you have devices staying that long then install Anyconnect to get full featured support.

The temporal agent is for temporal users like contractors that are short stay.

View solution in original post

6 REPLIES 6
hslai
Cisco Employee


BYOD clients lose posture status every time they log off/reboot (or perhaps more accurately, when they reconnect to the corproate SSID), but posture lease is set to 14 days and there is no periodic re-assessment configured. My understanding is that the posture lease should apply to all clients, but I may be mistaken there?

Temporal agent does not support posture lease. Please use regular AnyConnect ISE Posture for this. 

 

When BYOD clients are posture-assessed using the temporal agent, the first run through doesn't update the posture status in ISE - I need to be redirected a second time, run the temporal agent a second time and then I get full network access.


 Please ensure ISE PSN receiving a posture report. Use the ISE RADIUS Live Logs to check the authorization policy rule matched after PSN sending out the CoA and the network device re-authenticating the endpoint.

Thanks for that, appreciate the quick response.

 

Temporal agent does not support posture lease. Please use regular AnyConnect ISE Posture for this.


I guess the clients will be committed to re-running the temporal agent every time they connect then - no way to only force clients to re-assess every X days with the temporal agent?

 

Regarding the posture report, I'll take a more detailed look at the live logs and also do a capture on the PSN to see if I can catch any CoA being sent to the NAD.

Temporal Agents doesn't get installed on the clients. So temp agent cannot perform posture lease, clients need to download and run temporal agent every time to perform posture check.

 

The solution is to use Anyconnect Agent.

View solution in original post

Sounds good - they'll just have to live with a posture assessment every time they connect or get their BYOD users to install AnyConnect then.

I thought perhaps there was a way to have ISE do something clever with the temporal agent posture report - e.g. have it run when you connect at 1000 on Oct 31 and count that as 'valid' posture for X days, then after X days market them as non-compliant/unknown, issue a CoA to force them to re-run the temporal agent and get another X days of valid posture.

Regards,

David

No there is not. If you have devices staying that long then install Anyconnect to get full featured support.

The temporal agent is for temporal users like contractors that are short stay.

View solution in original post

Duly noted. Thanks everyone!
Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars



Did you miss a previous ISE webinar?

CiscoISE YouTube Channel