ISE POSTURE COA ISSUE

[tohuindo]

Posture is configured, and users must be compliant before being reassigned to their respective vlan. But in order for them to be able to check their posture status they are assigned to a temporary vlan that grant them minimal access to the network.

They match the temporary vlan policy when their eap-chaining is fully successful or when the machine authentication is successful. Now the issue is that most users get in that temporary vlan and received their posture and then a coa is sent so they can leave the temporary policy to go to their appropriate vlan but some users got sticked in that temporary vlan even though they were compliant 

[Marcelo Morais]

Hi @tohuindo ,

 1st double check the Posture Status at Work Centers > Posture > Reports > Reports > Posture Reports > Posture Assessment by Endpoint.

 2nd compare the Endpoints that are not OK with the Endpoints that are OK:

 a. double check if they have the same Authorization Rule (at Operations > Reports > Reports > Endpoints and Users > RADIUS Authentication).

 b. double check if they are in the same SW.

Note: for a better understand of the Posture flow, please check the ISE Posture Flow in ISE 2.2 Compared to Earlier ISE Versions.

Hope this helps !!!

[tohuindo]

Thank you for reply i will try to work on it and if anything i will let you know