@nicoff
My comments.
"When the option "Perform posture assessment every time a user connects to network" is enabled in ISE, it creates an infinite loop that forces the user to always go through the client provisioning portal."
The question to be made here is why client go to the provisioning portal. Meaning, the client should be sent to the portal if something is not find in the client, right?
"However, if we remove the portal ACL on the WLC as a test, the issue disappears, and users are able to initiate the scan via the AnyConnect button without getting stuck in the loop or receiving the "Unable to detect Posture Agent" message."
If you remove the ACL the problem disapears because the redirect will not take place.
"Everything works fine when we use the "Perform posture assessment every X Days" option, but we can't figure out why we're seeing this behavior with the WLC when using the first option."
Probably it will break when the X days comes. If the "Perform posture assessment every X Days" flag set, the ISE is not executing the posture assesment and it is not triggering the problem. But. when the period get to an end. the problem will probably happen again.
The conclusion is not simple here but the line of investigation should be try to identify why the ISE is forcing the client to be provisioned. IF the ISE were able to validate that the client have all it needs, it should not send the client to the portal over and over.
