11-22-2021 12:34 PM
Hi experts,
I probably should do more reading myself but I need to get this done quickly so appreciate any direct answers.
I need to reboot the PSN nodes as per the TAC for some certificate/portal page problem and I have never done that before so I want to know the impact level.
The two nodes are behind the load-balancer so I can easily turn off one while rebooting it so the one that's up will remain working. The impact should be limited. I assume that the endpoint data are shared so re-authentication for VPN or WiFi users on another node should continue to work, correct?
My concern is with the Posture check. First of all, how do I know to which PSN node the redirection is for? Here is the AV pair configured under the authorization profile. Where does it get the IP and Port from?
cisco-av-pair = url-redirect=https://ip:port/portal/gateway?sessionId=SessionIdValue&portal=27b1bc30-2e58-11e9-98fb-0050568775a3&action=cpp
I think the policy requires periodic posture checks. How does that work? Is it initiated by the PSN node or by the Anyconnect app? If the PSN node is in the reboot, does it cause the VPN user to be disconnected, or will it just keep trying while maintaining the connectivity?
Thanks!
Difan
Solved! Go to Solution.
11-23-2021 10:06 AM
I am going to provide some information that hopefully will assist you and hit on most of your questions.
I assume that the endpoint data are shared so re-authentication for VPN or WiFi users on another node should continue to work, correct?
-If the PSNs are in a node group, yes correct. Not sure what version of ISE you are running, but beware of this as this crippled me at one point way back in the day:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj47301
Lastly, take a peek at this as it should help cover items I may miss: ISE Session Management and Posture - Cisco
My concern is with the Posture check. First of all, how do I know to which PSN node the redirection is for? Here is the AV pair configured under the authorization profile. Where does it get the IP and Port from?
-Just so you know you have the ability to hard set a static host used in the authz profile. If you navigate to Work Centers->Posture->Client Provisioning->Client Provisioning Portal you can view which physical interfaces for PSNs are allowed via the portal config. As far as seeing the configuration that is deployed in your posture configuration profile you can view it 2 ways: within ISE: Policy->Policy Elements->Results->Client Provisioning->Resources: Find the anyconnect profile that gets assigned to the active CPP. The other way is via a client that is already provisioned: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture\ISEPostureCFG.xml. Keep an eye out for call home list (should list your PSNs).
This explains it perfectly and more in depth: AnyConnect ISE posture module discovery host and call home list – Cisco ISE Tips, Tricks, and Lessons Learned (ise-support.com)
I think the policy requires periodic posture checks. How does that work? Is it initiated by the PSN node or by the Anyconnect app? If the PSN node is in the reboot, does it cause the VPN user to be disconnected, or will it just keep trying while maintaining the connectivity?
-AFAIK after the PSN reboot, already authenticated clients with an active session will not be disconnected. Check your interim accounting update config to see what that is configured for/as. Also, if you have enabled the "scan again" button in ISEPostureCFG.xml then users will have the ability to trigger the probe again manually via user interaction. This button appears in the AnyConnect ISE Posture module. Also, note that if a user disconnects, a DFG change occurs, then this will trigger the probe to "phone home" and go through the discovery process again.
11-23-2021 10:06 AM
I am going to provide some information that hopefully will assist you and hit on most of your questions.
I assume that the endpoint data are shared so re-authentication for VPN or WiFi users on another node should continue to work, correct?
-If the PSNs are in a node group, yes correct. Not sure what version of ISE you are running, but beware of this as this crippled me at one point way back in the day:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj47301
Lastly, take a peek at this as it should help cover items I may miss: ISE Session Management and Posture - Cisco
My concern is with the Posture check. First of all, how do I know to which PSN node the redirection is for? Here is the AV pair configured under the authorization profile. Where does it get the IP and Port from?
-Just so you know you have the ability to hard set a static host used in the authz profile. If you navigate to Work Centers->Posture->Client Provisioning->Client Provisioning Portal you can view which physical interfaces for PSNs are allowed via the portal config. As far as seeing the configuration that is deployed in your posture configuration profile you can view it 2 ways: within ISE: Policy->Policy Elements->Results->Client Provisioning->Resources: Find the anyconnect profile that gets assigned to the active CPP. The other way is via a client that is already provisioned: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture\ISEPostureCFG.xml. Keep an eye out for call home list (should list your PSNs).
This explains it perfectly and more in depth: AnyConnect ISE posture module discovery host and call home list – Cisco ISE Tips, Tricks, and Lessons Learned (ise-support.com)
I think the policy requires periodic posture checks. How does that work? Is it initiated by the PSN node or by the Anyconnect app? If the PSN node is in the reboot, does it cause the VPN user to be disconnected, or will it just keep trying while maintaining the connectivity?
-AFAIK after the PSN reboot, already authenticated clients with an active session will not be disconnected. Check your interim accounting update config to see what that is configured for/as. Also, if you have enabled the "scan again" button in ISEPostureCFG.xml then users will have the ability to trigger the probe again manually via user interaction. This button appears in the AnyConnect ISE Posture module. Also, note that if a user disconnects, a DFG change occurs, then this will trigger the probe to "phone home" and go through the discovery process again.
11-27-2021 10:13 AM
Thank you Mike for the detailed explanation! Sorry for the late response on this...
I don't see any Client Provisioning Portal configured/listed... That is weird, isn't it? But it is empty on my ISE config...
My Call Home List is also empty... Does it mean that the ASA would automatically redirect to the server that deals with the authentication? Is there a command on the ASA to find where the redirection goes..? I think this is the one that puzzles me the most - I still can't figure out which PSN will be the one for the posture check...
Regarding the Interim accounting, I found the setting and it is set for periodic updates every 12 hours
aaa-server ISE_PRD protocol radius
interim-accounting-update periodic 12
dynamic-authorization
11-29-2021 12:07 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide