ISE posture checks over AnyConnect VPN failing

[tiryan]

Some Windows devices fail to connect to a PSN to complete a posture check After it connects to ASA via AnyConnect.

Device, Anyconnect, ASA and ISE versions are fine based on the lastest Compatibility Guides.

AnyConnect 4.5.02033 and ISE 4.2.1226.0

Do we have some known caveates or known Client PC settings that could STOP the Posture check sequence from occurring?

Do we have any step by step troubleshooting guides for posture checking flows.

TAC case is open but no progress so far.

Thank you,

Tim Ryan

[Craig Hyps · Accepted solution]

Please clarify if issue is with discovery, or with post discovery where AC is in redirected, posture assessment process.

If discovery, then for ISE 2.2, you can seed device with a discovery host that points to actual PSN.  Prior to ISE 2.2, the DH should NOT be PSN, but a target that will get intercepted by ASA and redirected to PSN.

Troubleshooting can be accomplished by AC logs (DART bundle) and via ISE debug logging for posture log. 

/Craig

[paul]

What method are you using to ensure posture discovery works?  I use port 80 to the default gateway usually.  In the case of VPN I just make sure my redirect list is redirecting port 80 to the VPN IP pool.

[paul]

Also one of the reasons it may work for some and not others is because one of the posture discovery steps is trying to connect to the previous PSN you submitted posture to.  So if they postures correctly on wired or wireless they may work just fine on VPN leading you to believe you have posture discovery setup correctly on VPN when in reality you don’t for clients that have never postured before.