ISE 3.1 lease setting and devices on 24x7

[cgarringer]

We are running ISE 3.1 patch 4 and rolling out wired connections with posture checking.   the issue we are seeing is with computers on 24x7 , we are a manufacturing plant.     With the lease setting at 24 hrs, and the the posture recheck at 12 hours, the computers will scan for posture automatically once at the end of 12 hours, but when the lease expires a user must login and select re-scan to get the device online.     Has anyone had devices that have to stay on 24x7 for up to months on ISE?    What did you do about the lease and rescan for posture?

[balaji.bandi]

if that causing the issue, if the industrial device is trusted, I will create a different profile and disable posture checks.

[cgarringer]

For the devices that would work but a significant portion of the systems are Windows PC’s that need to be checked for compliance.

[balaji.bandi]

so all windows PC are the industrial requirements? what windows  XP / 7 / 10 or 21H2 ?

[cgarringer]

Nothing older than 10, most should be 21H2.

[Aref Alsouqi]

Are you doing the posture assessment via AnyConnect? and are you referring to the lease in the reassessment page or the general posture assessment settings?

[cgarringer]

The reassessment is set to 12 hours, the general setting is 24. The AD group is looking at a possible solution, they have found that the ISE posture services can be stopped/started and that causes a re-scan that appears to keep the PC connected. They tried it on one machine, they are expanding the test.

[Dustin Anderson]

I have not tested, will a radius reauth of the port trigger a rescan? We only use AnyConnect for wireless and they tend to bounce on/off all day so never had an issue.