ISE Posture update issue

[uRLKuzE]

Hello mates,

I’ve seen this error while trying to do a posture update: “Feed cannot be generated or parsed”:

We have it for two weeks now and we patched our deployment yesterday but the issue is still here. When I try a to update now, I see my proxy going to cisco.com and it doesn’t block anything.

Could it be an issue on Cisco side ?

Thank you!

[arthur35rooney]

That Cisco ISE posture update issue usually comes from outdated AnyConnect posture agents, missing compliance modules, or mismatched policy conditions. The fix is to update the compliance module, align the posture policy with endpoint requirements, and review client/ISE logs to pinpoint where validation fails.

[uRLKuzE]

Thank you.

Just to clarify, posture evaluation is working for our endpoints, at least for now. It's the posture update, of the security definitions etc... that doesn't work anymore. Looking at the URL that is configured by default when you configure the web update https://www.cisco.com/web/secure/spa/posture-update.xml I'm getting a strange result:

Could it be that the URL was change on Cisco side ? 

[Greg Gibbs · Accepted solution]

Yes, there appears to have been a change to that URL as well as the URL for the Client Provisioning updates. I have suggested another customer open a TAC case and request that a bug is opened to fix documentation as well as the default URL configuration in ISE. You might do the same to highlight the issue from multiple customers.

If you change those URLs to the below, they should work (they work for me in ISE 3.5p3).

Posture updates - https://iseservice.cisco.com/ise/posture-update.xml

Client provisioning updates - https://iseservice.cisco.com/ise/provisioning-update.xml

[uRLKuzE]

Thank you, it confirms my suspicions.

After changing the URL to https://iseservice.cisco.com/ise/posture-update.xml on our two deployment (running versions 3.2 P10 and 3.4) the updates work again:

it's weird that the change is not at least indicated in a release note somewhere, for exemple in the posture update documentation https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-32/222854-perform-posture-updates-in-ise-offline-a.html#toc-hId-588194424 

[Gagandeep Singh]

Important notice:- Posture Feed URL Clarification

@Greg Gibbs @uRLKuzE 

There is no permanent Posture Feed URL change. The default Cisco ISE Posture Feed URL remains the same, and Cisco is working to restore/fix access to the current default URL.

DEFAULT URL

https://www.cisco.com/web/secure/spa/posture-update.xml

TEMPORARY WORKAROUND

If customers are currently unable to retrieve posture updates from the default URL, they may temporarily configure the alternate URL below.

https://iseservice.cisco.com/ise/posture-update.xml

Once Cisco restores/fixes access to the original default URL, customers should revert their ISE configuration back to the default URL.

Hope this information helps!!!

Regards

Gagandeep Singh

[iainmcguire]

Are these posture feeds being updated? 

Apple release Golden Gate version 27.2 yesterday (26th October 2026), but the last update for version 27, in the posture feed, was back on 17th June 2026 ; 

<OSGroup name="MAC_OSX_27_ALL" displayName="MAC OS 27 (All)" supportPosture="true" supportProvisioning="true" supportSCEP="true" osVersionType="WILD_CARD" osversion="2.27.*">

<OS displayName="MAC OS 27.0" name="MAC_OS_64_MINOR_27_0_beta" osversion="2.27.0"/>

</OSGroup>

This "wildcard" definition does not match 2.27.2, and users on that version cannot successfully perform ISE posture or compliance checks, as of upgrading from 2.27.0 (which is listed as a "beta version", despite being fully released on September 14th 2026 ...

I've logged a TAC case for this, but maybe someone should review whether the OS versions in the posture feed are actually being updated? 

The last dated update was 17th June 2026 ; 

https://iseservice.cisco.com/ise/posture-update.xml

<entry>

<id>https://iseservice.cisco.com/ise/SupportedOSsV6/112.6.3</id>

<title>Cisco Supported OSs V6</title>

<updated>2026-06-17T12:00:00Z</updated>

<summary>Cisco Supported OSs V6</summary>

<update:type>SupportedOSsV6</update:type>

<update:version>112.6.3</update:version>

<link rel="enclosure" type="application/x-tar-gz" href="https://iseservice.cisco.com/ise/repository/SupportedOSsV6/112.6.3/osgroupsV6.tar.gz" length="5804"/>

</entry>

[Gagandeep Singh]

@iainmcguire  Cisco is still using default URL for client provisioning and posture feed.

The ISE Day-0 team is responsible for validating both production and beta client OS releases. Please note that official support documentation is typically finalized following FCS.

I would advise to start using "Enhanced support for unvalidated operating systems releases in posture workflows" (also known as Greenfield OS Support).
I have created an article on this too
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-posture-support-for-unvalidated-os-amp-beta-releases/ta-p/5579383

Excerpt:-

A posture feed update is not required for every new major macOS release (for example, 27.x, 28.x), provided that the existing OS family definition (for example, "MAC_OSX") can successfully classify the endpoint.

The Enhanced Support for Unvalidated Operating Systems feature is designed to allow posture assessment and client provisioning to continue for newer OS versions that have not yet been explicitly added to the posture feed, as long as they are matched by an existing broader OS family definition.

Hope this helps as a strategic solution!!!!

[iainmcguire]

Hi, thank you for the links, however I believe that Greenfield support is an ISE 3.3 feature. We're in the middle of a migration to 3.5, and our current production environment is 3.2, which is still a supported product track.

As such, there is no support on 3.2, for making the change you suggested, and the product feed is broken for customers on ISE 3.2, which again, is a Cisco supported product track, which is not yet even end of sale. 

Regarding the link to the article on this, the article has this detail in it ; 

Official Release Notes Reference: Cisco Identity Services Engine Release Notes, Release 3.3 - New Features

That link to the new features in 3.3 goes to a 404 error page.

So i'm afraid that a posture feed update *IS* still required for every new macOS release, unless Cisco are saying they're now dropping support for new macOS releases, for customers on ISE 3.2? 

[Gagandeep Singh]

Yes the feature is supported from 3.3 onwards.
However, I just updated the posture feed using the default URL on 3.2
https://www.cisco.com/web/secure/spa/posture-update.xml

It did update the feed and posture policy started showing MAC OS 27 (ALL)

3.2 doesn't give me option to check the posture offline file. However, I did download the posture offline file from 3.5 version and can see all 27.x minor versions.

<OSGroup name="MAC_OSX_27_ALL" displayName="MAC OS 27 (All)" supportPosture="true" supportProvisioning="true" supportSCEP="true" osVersionType="WILD_CARD" osversion="2.27.*">

<OS displayName="MAC OS 27.0" name="MAC_OS_64_MINOR_27_0_beta" osversion="2.27.0"/>

<OS displayName="MAC OS 27.1" name="MAC_OS_64_MINOR_27_1" osversion="2.27.1"/>

<OS displayName="MAC OS 27.2" name="MAC_OS_64_MINOR_27_2" osversion="2.27.2"/>

<OS displayName="MAC OS 27.3" name="MAC_OS_64_MINOR_27_3" osversion="2.27.3"/>

<OS displayName="MAC OS 27.4" name="MAC_OS_64_MINOR_27_4" osversion="2.27.4"/>

Hope this helps!!!

[iainmcguire]

Thank you, that does help - Cisco have now updated the posture feed to include the new 2.27.2 version, and also versions which do not yet exist, like 2.27.3 and 2.27.4 - None of these were in the posture feed yesterday, which was my point

The default URL on 3.2 of https://www.cisco.com/web/secure/spa/posture-update.xml has nothing in it. If you open it in a browser, it only contains a link to the other URL I provided earlier. The entire content of that default URL is just an alternative link, it's this ; 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:update="http://www.cisco.com/cpm/update/1.0">
<title>Posture Update</title>
<updated>2019-05-23T10:00:00Z</updated>
<id> https://www.cisco.com/web/secure/spa/posture-update.xml </id>
<author>
<name>Cisco</name>
<email/>
</author>
<link rel="alternate" href="https://iseservice.cisco.com/ise/posture-update.xml"/>
</feed>

And if you go to the alternative link, you'll see that v6 of the supported OS has been updated, in the posture feed, on 2026-10-28 - this is AFTER I posted saying the last time that v6 was updated, was back in July of 2026 ; 

<entry>
<id>https://iseservice.cisco.com/ise/SupportedOSsV6/113.6.3</id>
<title>Cisco Supported OSs V6</title>
<updated>2026-10-28T12:00:00Z</updated>
<summary>Cisco Supported OSs V6</summary>
<update:type>SupportedOSsV6</update:type>
<update:version>113.6.3</update:version>
<link rel="enclosure" type="application/x-tar-gz" href="https://iseservice.cisco.com/ise/repository/SupportedOSsV6/113.6.3/osgroupsV6.tar.gz" length="5852"/>
</entry>

So Cisco have now updated the posture feed, to support ISE 3.2, which was the entire point I was making - that they need to do this, because it won't work, till they do 

So thank you, but it's not that I just needed to update the posture feed with the default URL, the posture feed did not contain the necessary information, when I originally posted, and now it does. 

So thank you for fixing it, I appreciate it, and our users appreciate it.

[Gagandeep Singh]

Glad it worked. Once you upgrade ISE to 3.5. It will improve lots of other features.

Please rate the solution!!!!

[tyoung008]

I got this alert when I logged into ISE 3.4 Patch 7.

I checked the URLS.

• Administration > System > Settings > Posture > Updates = default URL.
• Administration > System > Settings > Client Provisioning = updated URL provided by @Greg Gibbs .

I found the default URL for client provisiong in this doc -> https://www.cisco.com/c/en/us/td/docs/security/ise/3-4/admin_guide/b_ise_admin_3_4/b_ISE_admin_compliance.html.  It says that the URL should be https://www.cisco.com/web/secure/spa/provisioning-update.xml.  When I changed the URL to default, Work Centers > Posture > Client Provisioning > Resources > Add > Agent resources from Cisco site no longer works.  I changed it back to the new URL and it works.

So, it looks like client provisioning URL has changed, and the documentation/URL is broken.

Thanks,

Tom

[Gagandeep Singh]

@tyoung008 

Like posture feed, this could be temporary workaround and will revert if the documentation not updated.
However, I would advise to open TAC case and get it confirmed.

Regards

Gagandeep Singh