cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
538
Views
0
Helpful
6
Replies

Non-working rules in Cisco ISE for posturing services on MacOS

Hello everyone!

We need to understand why ISE posture fails on process checks on MacOS.

For example, we need to check that the datalossd or datalosste processes are running. Here is an example of output from one device, where you can see that the processes are running:

AleksandrPashko_0-1676639038724.png

This is what the enabled checks look like:

AleksandrPashko_1-1676639142409.pngAleksandrPashko_2-1676639170204.png

As far as I understand, by design it should not give any error. It's just that the system scan does not consider the process running. He simply does not see him, hence he believes that the condition fails. I attached screenshots of the troubleshoot, but in fact they just say that the air conditioner has failed.

 

AleksandrPashko_4-1676640138202.pngAleksandrPashko_5-1676640226424.png

Moreover, each of these checks fails and it is not very clear why.
Perhaps you need to specify the process name in some other way or take it in some other place or with some kind of prefix.
Please help/suggest what we are doing wrong and how to make it work correctly? For example, for windows, if you specify the name of the process, as it is visible in system monitor, then such a check passes successfully.

6 Replies 6

Rodrigo Diaz
Cisco Employee
Cisco Employee

hello @Aleksandr Pashko, are you using the latest compliance ? if you don't please make sure you are using it in the machines affected , ensure also that the posture feed is also updated within ISE . 

Let me know if that helped . 

I was referring to the latest ISE compliance module in my latest post.  

The OPSWAT module version is 4.3.2661.4353

Hello

thank you for the answer 

You mean the compliance module in the AnyConnect for MacOS?

yes I meant that module .

The OPSWAT module version is 4.3.2661.4353

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: