I am going to provide some information that hopefully will assist you and hit on most of your questions.
I assume that the endpoint data are shared so re-authentication for VPN or WiFi users on another node should continue to work, correct?
-If the PSNs are in a node group, yes correct. Not sure what version of ISE you are running, but beware of this as this crippled me at one point way back in the day:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj47301
Lastly, take a peek at this as it should help cover items I may miss: ISE Session Management and Posture - Cisco
My concern is with the Posture check. First of all, how do I know to which PSN node the redirection is for? Here is the AV pair configured under the authorization profile. Where does it get the IP and Port from?
-Just so you know you have the ability to hard set a static host used in the authz profile. If you navigate to Work Centers->Posture->Client Provisioning->Client Provisioning Portal you can view which physical interfaces for PSNs are allowed via the portal config. As far as seeing the configuration that is deployed in your posture configuration profile you can view it 2 ways: within ISE: Policy->Policy Elements->Results->Client Provisioning->Resources: Find the anyconnect profile that gets assigned to the active CPP. The other way is via a client that is already provisioned: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture\ISEPostureCFG.xml. Keep an eye out for call home list (should list your PSNs).
- Call Home List: Comma separated list of FQDNs and port numbers (FQDN and port number separated by colon). The port number is whatever port is configured for the client provisioning portal. The default port number is TCP/8443 if it is not specified in the list. The PSNs are accessed in the order in which they are presented in the list.
This explains it perfectly and more in depth: AnyConnect ISE posture module discovery host and call home list – Cisco ISE Tips, Tricks, and Lessons Learned (ise-support.com)
I think the policy requires periodic posture checks. How does that work? Is it initiated by the PSN node or by the Anyconnect app? If the PSN node is in the reboot, does it cause the VPN user to be disconnected, or will it just keep trying while maintaining the connectivity?
-AFAIK after the PSN reboot, already authenticated clients with an active session will not be disconnected. Check your interim accounting update config to see what that is configured for/as. Also, if you have enabled the "scan again" button in ISEPostureCFG.xml then users will have the ability to trigger the probe again manually via user interaction. This button appears in the AnyConnect ISE Posture module. Also, note that if a user disconnects, a DFG change occurs, then this will trigger the probe to "phone home" and go through the discovery process again.
