Rollout ISE Posture challenge

[Freemen]

Hi all,

if customer have no SCCM, to push the anyconnect core, posture etc to the client and the method they use is via another software management engine, which seam like not reliable. 

anyway to deploy the 1k endpoint with posture without interruption?

scenario: Wired/ Wireless endpoint, GPO pushed, Client connected to network but no anyconnect agent, stuck at posture redirect.

[agrissimanis]

To start, make sure that the redirect ACLs are correct on your switches and wireless controllers, so that the endpoints that do have Anyconnect successfully predeployed can discover and connect to ISE PSNs.

For these endpoints that do not have Anyconnect predeployed in advance, user needs to open a browser and attempt to open any HTTP website. This should trigger a redirect in browser to the client provisional portal from where the user can download and install Anyconnect client (admin rights are likely needed for this). Anyconnect will not automatically install by itself, even if the endpoint is under posture-redirect ACL. That first time install needs user intervention. Future updates to AC or posture module can be automatic without the need for user to do anything.

[Jason Kunst]

---

@agrissimanis wrote:

To start, make sure that the redirect ACLs are correct on your switches and wireless controllers, so that the endpoints that do have Anyconnect successfully predeployed can discover and connect to ISE PSNs.

For these endpoints that do not have Anyconnect predeployed in advance, user needs to open a browser and attempt to open any HTTP website. This should trigger a redirect in browser to the client provisional portal from where the user can download and install Anyconnect client (admin rights are likely needed for this). Anyconnect will not automatically install by itself, even if the endpoint is under posture-redirect ACL. That first time install needs user intervention. Future updates to AC or posture module can be automatic without the need for user to do anything.

---

A couple recommendations here. I wouldn't recommend redirecting or blocking all traffic at the general redirect stage for non-compliant or unknown status. You can block access to highly secure items but allow access to internet and maybe basic employee services if you like so the user is not completely blocked. When they try to access critical secure internal resources you can also redirect on those. This would prevent issues with apps being blocked and throwing weird errors confusing and annoying the users (think outlook). I would recommend pre-installing so that the agents are ready to go with proper XML file. If a client doesn't have it you can redirect users to use enroll.cisco.com to posture as part of general on-boarding requirements.

[Timothy Abbott]

If you can't use a software deployment solution such as SCCM or other than you could always use ISE as the deployment mechanism. You will just need to ensure that your network access devices are capable of assisting in the deployment.

Regards,
-Tim