ISE Posturing to check if system belongs to domain

[User_80617]

Hi Guys,

Need help. We are doing posturing on ISE for internet VPN users. Want to configure ISE posturing to check if system belongs to domain to allow it the access. What are the configuration options available. 

[balaji.bandi]

Is the device known or unknow, if the known you have Cisco any connect client to take control do the posture check ?

is this what you looking ? or BYOD ?

some reference :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_compliance.html#concept_A9C0E9F58A4A4FECBC9C5BB362F9B403

[User_80617]

Hi Bala,

So we are not doing byod. Only domain system shall connect to the vpn. What is safest way to implement with lesser impact before going to prod apply.

[Rob Ingram · Accepted solution]

@User_80617 

You can check a registry value when performing ISE posture, which checks to see if the computer is joined to your domain.

Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain Value=your.domain.name

Another option would also be to use computer certificates, which could only ever be issued by your internal CA. Though posture doesn't check the certificates, it's the ASA/FTD that would validate the cert, but it proves the computer is a corporate asset.

HTH

[Ernestas Sabukevicius]

Good solution but it works only as requirement. I wonder if there is another one for selecting a different Policy based on belonging to a domain.

For example i can do a selection based on belonging to specific OS in Policy Sets with creating a LogicalProfile:

[Mike.Cifelli]

Adding an additional option besides what @Rob Ingram shared as those are good options.  You could also target specific enterprise resources that should be on your standard image (ie- ensure McAfee products are installed/running/etc.).  I actually use the domain reg check with one customer plus additional items and they work great.  Ultimately I think this comes down to what you feel you can target based on what you know is required on clients in your enterprise.  HTH!

[User_80617]

Hi,

Is there any way to see if the user system name is also joined domain? This is to be configured on vpn and not 802.1x.