ISE Posture Bad User Experience

[Hemant Bharati]

Hi All,

I have customer deploying Wireless Infra with Cisco ISE , everyday there are issues with anyconnect posturing example...

1. The time taken is very uneven , sometime it is in 2mins to 45mins or may not connect also .

2. Same user which was compliant in the morning , when move from one campus building to another it goes into non complaint state when want to be on network.

3. Users are complaining  that they get disconnected or get pop up page to install Anyconnect even when it is installed.

Can someome help here...

[hslai]

Thanks for the posting. If not done already, please engage Cisco TAC on this. Ask the customer to collect an AnyConnect DART whenever abnormal behavior arise.

[Hemant Bharati]

Cisco TAC is involved ,

Can you please let me know what is the Ideal time taken for Posturing ?

[hslai · Accepted solution]

IMHO a minute or two is fine. Anything longer than that, users will complain.

Many things can come into play, tho. Network connectivity (especially in wireless), types of posture conditions (Microsoft patch checks can take a long time, for example) and means of remediations.

[imbashir]

Typical posture times are certainly much less than the ones reported

I would suggest leveraging posture features like Posture Lease + Passive Re-Assesment which would limit posture checks at every install time but would still check posture at a configured interval

I'm not sure why are users getting un-install option, could be that Firewall is also configured to install AC and there are version inconsistencies

Thanks

Imran