Posture initiation once recovered from Critical auth scenario

[dngore]

Hi,

We are deploying ISE 2.4 with Anyconnect 4.6 and Cisco IOS 15.2.4.E6 on 2960 Plus switch.

Customer wants dACL as authorisation instead of Clan change.

We have defined same data vlan as critical auth vlan.  

When switch detects ISE server reachability (recover from critical auth scenario), it starts reinitilaization i.e authentication & authorisation cycle. But it is observed that posture process initiation depends on network change like vlan change (by using IP refresh option). In our case, as we are using same vlan for critical auth, there is no network change detected and hence no posture initiates. 

Is there any way that we can start posture based on NAM inputs i.e. basically on authentication event? 

How should we tackle this issue?

Regards,

D.M.Gore

[hslai · Accepted solution]

When NAM starts DOT1X, it might trigger a network change event. Otherwise, ISE 2.4 and AnyConnect 4.6 have an option to enable "Rescan" Button. Please try that.