ISE WIRELESS POSTURE

Ughur · ‎07-17-2023

Hi everybody.

I have configured posture for wireless authentication. But when i connect to wireless network reditecting not work. Can you help me?

marce1000 · ‎07-17-2023

- What is the wireless architecture : elaborate on controller model(s) , AP model(s) , software versions , ...

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Dustin Anderson · ‎07-17-2023

As Marce said, you didn't give much info, so I will make some assumptions and give you some to look at.

Assumptions: ISE, AirOS WLC, Lab.

When you are doing a posture assessment, the device should be basically quarantined during the time. This is usually done with a wireless ACL that ISE will call. These are spots you could need to check.

1) Syntax of the ACL. ISE will call the exact name you enter in the WLC, capitol letter or lower case does matter. ACL and Acl are different.

2) on the WLC SSID, under advanced make sure the NAC is set to ISE NAC, otherwise the WLC will ignore what comes back from ISE.

3) Make sure you have AnyConnect set up for whatever you want to check and the config is set in ISE. AC will only return a pass/fail, you will not see in ISE if anything is wrong.

4) Make sure the wireless ACL allows the client to do DHCP and DNS. And if there is a firewall that they can talk to the ISE server.

Anything else and you'll need to be more specific of what the issue is and what config you have.

Ughur · ‎07-21-2023

Thanks for replying.
I can configure this step. Now, when i tr connect to wireless, cisco ise redirecting portal. But i can not download anyconnect, getting error. Then i installed anyconnect packages manually on windows.

Now, Cisco Anyconnect system scan status is "Compliant" even if user must be "not complain". I'm adding new requirements but status not change to "non-compliant.

Ughur · ‎07-21-2023

Dustin Anderson · ‎07-21-2023

When you set up, you will usually set a time to recheck posture. So, if you want to recheck before that time is up I usually have to delete the endpoint from ISE.

thomas · ‎07-21-2023

Please see How to Ask The Community for Help .

You have not even included a error, a configuration, or anything for us to comment on or suggest in your initial post.

Please review our existing https://cs.co/ise-resources or https://cs.co/ise-guides for potential guides including https://cs.co/ise-posture for Posture Configuration.