Posture compliant state not changing after restricted app turn on

[asu ayyoub]

I am using  any connect  posture on RM vpn, i have restricted Application list on posture condition and it works when the application on while posture checking. for example Bittorent. the issue is once the posture become compliant (during this time app is not running), if i turn on the restricted applications (after posture compliant), posture not turning back to non compliance status. is this normal ? posture will not check live status ?  any one can help.

[Rodrigo Diaz · Accepted solution]

hello @asu ayyoub, the ISE posture module will not redo assessment unless there is one of the following scenarios:

• Initial ISE posture module installation.
• User login.
• Power events.
• Interface status change.
• OS resume after sleep.
• Default Gateway (DG) change.

What you can also do in this scenario at least from ISE side is to configure Posture Reassessment (PRA) in which you setup periodic reassessments within your implementation to review. 

For your reference: 

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_compliance.html#reference_0CB881C7DFAE41228EAE8F23F3360B17

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html#anc16

Let me know if that helped you.

[hslai]

Take a look at Configure 2.2 Client Provisioning and Application 

[asu ayyoub]

Thanks Team, it is clear