ISE posture assessment flow:
In order to do posture check on the windows endpoint (Wired & wireless), we will initially assign the machine in production data vlan with limited network access for redirecting the browser traffic to Cisco ISE NAC posture portal URL where user will have an option to download and run the posture agent. After posture assessment, when the machine is identified as compliant machine, ISE will assign the full access role in the production data vlan. If the machine is identified as non-compliant machine, then it will be moved to quarantine vlan.
Current Issue:
Once the machine is identified as compliant machine, ISE is assigning the full access role to the user machine and all other application works normally. But Outlook application status shows ‘Disconnected’. It is taking more time to become connected status (approximately 5 mins to 15 mins).
Our observation:
Generally in the client environment Windows machine is trying to connect outlook [outlook.office365.com] via proxy IP only [xxx.xxx.xx.xx over port 3128]. But after posture assessment, windows machine is trying to connect with outlook IPs directly instead of accessing via proxy IP for few minutes (5 mins to 15 mins) and getting no response (As 80/443 traffic is allowed via proxy only). When the windows machine try to connect outlook via proxy, connection is allowed and Outlook application is started working.
We are not sure why the Windows machine is taking more time to sending the traffic via proxy even though the machine is assigned with full access to the network by Cisco ISE NAC.
We are looking for your help to identify and resolve the issue.
