ISE Posture checking Mcafee definition up-to-date.

[Nate Zhang]

When testing, we found there would be one situation as following. Our Setup;

• Posture Policy is configured 'Check against latest AV definition file version if available.'
• ISE is updating Posture database every 2hrs.
• EPO server （On Premises) is updating the database once a day.

Testing steps:

1. ISE is updated to version X while EPO server is X-1 yet.
2. When booting up the endpoint whose definition version is much older like X-5, ISE indicates it is non compliant and initiates remediation.
3. The endpoint will sync up with EPO server and updates to X-1.
4. ISE still takes endpoint as non compliant since its own version is X and expect the endpoint upgrades to X.

It should be a corner case and we can avoid this case by using posture policy 'Allow virus definition file to be  X  days older than last file date'.

I was just curious if there is any feature to make ISE and EPO server have the same version anytime in case endpoint is blocked due to ISE or EPO server failed to update their database and mess up the production.

[Francesco Molino]

Hi
On ISE, except configuring to accept x-1 signature, there's nothing more you can do.
I'm not a McAfee expert, but is there any config you can do to check more often as 1 per day?

[Nidhi · Accepted solution]

Other than using the option of 'X days older than last file date'., you can also make use of grace period in your posture policy so that access is not completely blocked. 

More information here

Thanks,

Nidhi