cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

529
Views
10
Helpful
6
Replies
Beginner

Finding out whether ISE is enabled and working on a Host

Hello,

 

Just got an unusual request from one of our customers, they want to see the clients/hosts which are sucessfully running ise (with posture) using tenable (Nessus), they know it can be checked on ISE but they want to see it on thier Nessus. Just want to know if anyone knows which service to check for or a registry key or any command line (command) could be used. 

 

T&R

 

 

6 REPLIES 6
Beginner

Re: Finding out whether ISE is enabled and working on a Host

Hi Arjun,

 

You could check if Anyconnect ISE posture agent service is running (aciseagent). You could also check the wired/wireless autoconfig services (dot3svc/Wlansvc) to see if 802.1X supplicant is running.

However even if these two services are running, it wouldn't prove that the authentication has been successful (in monitor mode, for example, the authentication/posture could have failed, but the machine still has network access, the switch might not even be configured for dot1x and the supplicant has the fallback option enabled so network access is allowed regardless, etc)

If you can run psexec style queries from Nessus, you could remotely execute and parse the output from "netsh lan show interfaces" to get the actual authentication status of the interfaces. Similar queries could be executed using WMI and Powershell("get-wmiobject win32_networkadapter" and filter by connection state) , depending on the capabilities of Nessus. I have never looked at registry keys in regards to dot1x, there might be something that you could use.

 

Regards,

Agris

 

Please vote if helpful

Beginner

Re: Finding out whether ISE is enabled and working on a Host

Dear Agris,

 

Thank you for your response,. I will ask the customer to check on nessus side with the psexec query and see if we get a desired output.

------

Update:

There was nothing we could get from the query which would indicate that the user is configured and autheticated via ISE unfortunately.  

 

T&R

Beginner

Re: Finding out whether ISE is enabled and working on a Host

From the netsh output you should get something like this - 
Name : Local Area Connection
Description : Realtek PCIe GBE Family Controller
GUID : 68eb6c81-93be-4efa-8616-a61c5
Physical Address : AA-BB-24-E2-FB-DF
State : Connected. Authentication succeeded.

If you are able to parse multi-line output, you could check the State: row. This indicates the link status and authentication status. On a PC where authentication fails I get this:

State: Connected. Authentication failed.

Or if the switchport is not enabled for 802.1X, you should get this:

State: Connected. Network does not support authentication

The success of these queries depends on multiple factors, including your OS versions, permissions, credentials, etc. I suspect you would need to spend some time to get it working reliably. This is not a very elegant way obtaining the authentication status remotely, it is just the first method I thought of. WMI and Powershell would probably be more efficient. And even then, this information does not include the posture status, just the authentication status.

Highlighted
Beginner

Re: Finding out whether ISE is enabled and working on a Host

Dear Agris,

 

Thank you for the follow up post and i will take note of the outputs and try the same on thier enviormment. Will update tomorrow about the results on the same. 

 

T&R 

Beginner

Re: Finding out whether ISE is enabled and working on a Host

From the netsh output you should get something like this - 
Name : Local Area Connection
Description : Realtek PCIe GBE Family Controller
GUID : 68eb6c81-93be-4efa-8616-a61c5
Physical Address : AA-BB-24-E2-FB-DF
State : Connected. Authentication succeeded.

If you are able to parse multi-line output, you could check the State: row. This indicates the link status and authentication status. On a PC where authentication fails I get this:

State: Connected. Authentication failed.

Or if the switchport is not enabled for 802.1X, you should get this:

State: Connected. Network does not support authentication

 

The success of these queries depends on multiple factors, including your OS versions, permissions, credentials, etc. I suspect you would need to spend some time to get it working reliably. This is not a very elegant way obtaining the authentication status remotely, it is just the first method I thought of. WMI and Powershell would probably be more efficient. And even then, this information does not include the posture status, just the authentication status.

Beginner

Re: Finding out whether ISE is enabled and working on a Host

Hi Agris,

 

I beleive this will hold good if WiredAutoconfig is enabled, .i.e using windows native adapter for authentication, with Anyconnect enabled we get the below output

image.png

T&R