ISE Posture with Anyconnect - Standalone mode

[Anis Gharbi]

Hello Everyone,

I'm installing Cisco Anyconnect ISE posture module to do the posture using ISE version 2.2. We are are planning to the to the installation using a Microsoft GPO to execute the installation on the domain machines.

I have two questions:

1. I would like to know if it is possible to install Cisco Anyconnect ISE posture module in standalone mode and without installing the Cisco AnyConnect Secure Mobility Client for VPN ?

2. Where can I find the ISE posture module (that contains the network configuration) to perform the remote installation using GPO ?

Thanks,
Anis GHARBI

[Rahul Govindan · Accepted solution]

Answers to your questions:

1) No. The VPN module is the core module, without which other modules cannot be installed. However, you can hide the VPN module tile and only keep the posture module tile by adding a custom VPN_Service_Disable xml profile into the VPN profile location.

Profile: Attached (rename to .xml before using)

Location:

C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

2) I am not sure of this question. The Anyconnect Posture module should be inside the Anyconnect Pre-deploy zip file for Windows.

[Anis Gharbi]

Hello Rahul,

Thank you for the answer. I succeeded to configure the AnyConnect with only the posture tile using the XML file. 

Regarding the second question, we are scheduling to deploy the Cisco Anyconnect in a large enterprise deployment to check the compliance of windows machines. So now I’m searching how to do that in seamless manner with applying the Cisco best practices ?

Regards,
Anis

[Rahul Govindan]

In the past, I have deployed the Anyconnect VPN, Posture and ISE Compliance module through SCCM before rollout. They exist as individual installers on the Cisco download page. Once you deploy the right modules and have client provisioning configured on ISE, the posture profile should automatically be pushed during first connection attempt.