Wireless Anyconnect Posture failure

[pcno]

Hi ,

I am trying to do a wireless posture system scan via Anyconnect everything is configured as per the document, I got the redirect page and it downloads and installs the Anyconnect software but after installation, it doesn't start the system scan.
In the log, it says Unauthorised policy server. In the Posture folder .XML file I can see my ISE IP & the Profile name.

I am attaching all screenshots.
Please tell me how to fix this error.

Thanks

[Mike.Cifelli · Accepted solution]

From AC documentation: Unauthorized policy server—The host does not match the server name rule of the ISE network so there is limited or no network access.
AFAIK I think there could be a discrepancy between your ise posture profile config server name rule and the ISE cert. Are you able to test and modify the server name rule to just include '*' to see if it will work? Can you share how your cert is setup? Is your server name identified at the bottom of the chain? If using a wildcard like your server name rule depicts is the cert a wildcard cert with the psn hostnames as configured as SAN?

[pcno]

Thank you, Mike, for the quick reply I am using *.domain.com and getting this error. Please check the attached screenshot, it has all config details.
ISE20.DOMAIN.COM is the cert common name there isn't any SAN field & .205 is the IP of my ISE (Version 2.4).

This default cert is already kept in the client computer trusted store as well.

Thanks
Priyesh

[Mike.Cifelli]

Try changing your server name rule to: ISE20.DOMAIN.COM and testing the overall setup. I suspect that in order to get this working as you are expecting with the server name rule you may need a new cert.

[pcno]

I tried putting * and it worked earlier I was trying *.Domain.com now by simply putting a * without any domain name it worked.

Thank you for your help.