We have a wireless solution for contractors entering our facilities which includes 802.1x via ISE with posture assessment using the temporal agent. Contractor connects to SSID, authenticates and hits our authorization rule for client provisioning. Once connected to the SSID, they open a web browser and get redirected to the PSN and download the temporal agent which scans the laptop to check for anti-malware, etc. the CoA is sent and they then hit the 2nd authz rule to permit access based on an ACL. This is working in several locations with some tweaks to windows defender on the windows laptop. We are now seeing contractors come in, connect to their SSID download the temporal agent, the scan begins and they receive an error saying the laptop cannot contact the policy server. We see the initial radius authentications in the ISE logs, but nothing after that. We ensured the Windows Defender is disabled. We've shut down the windows firewall completely. In one instance a user receives a message that their group policy is blocking it, but the other contractors do not receive this message. We've check ACLs on the WLC and core switches. No firewall blocking access. Has anyone else run into this? How did you resolve it?
