ISE Posture update issue

[uRLKuzE]

Hello mates,

I’ve seen this error while trying to do a posture update: “Feed cannot be generated or parsed”:

We have it for two weeks now and we patched our deployment yesterday but the issue is still here. When I try a to update now, I see my proxy going to cisco.com and it doesn’t block anything.

Could it be an issue on Cisco side ?

Thank you!

[arthur35rooney]

That Cisco ISE posture update issue usually comes from outdated AnyConnect posture agents, missing compliance modules, or mismatched policy conditions. The fix is to update the compliance module, align the posture policy with endpoint requirements, and review client/ISE logs to pinpoint where validation fails.

[uRLKuzE]

Thank you.

Just to clarify, posture evaluation is working for our endpoints, at least for now. It's the posture update, of the security definitions etc... that doesn't work anymore. Looking at the URL that is configured by default when you configure the web update https://www.cisco.com/web/secure/spa/posture-update.xml I'm getting a strange result:

Could it be that the URL was change on Cisco side ? 

[Greg Gibbs]

Yes, there appears to have been a change to that URL as well as the URL for the Client Provisioning updates. I have suggested another customer open a TAC case and request that a bug is opened to fix documentation as well as the default URL configuration in ISE. You might do the same to highlight the issue from multiple customers.

If you change those URLs to the below, they should work (they work for me in ISE 3.5p3).

Posture updates - https://iseservice.cisco.com/ise/posture-update.xml

Client provisioning updates - https://iseservice.cisco.com/ise/provisioning-update.xml