ISE Posture check before login into computer - wired dot1x

[Srin_G]

Hi all,

ISE Posture check before login into computer - wired dot1x - can this be achieved?

We are running Cisco ISE v2.1 patch 3

Posture check requirement:

1) AV service enabled

2) updated AV DAT file - checks the registry for date

3) whitelisting software service enabled

Authentication: Machine certificate

this works fine after login but we use local script to map drives for the users because group policy wont let map drives while the computer is checking the posture.

I wonder we can do this posture check and put the machine in right vlan before the user logon.

regards

[Octavian Szolga]

Hi,

Posture check cannot be done before user login. Still, maybe you can run the scripts with a specific delay in order for posture to complete.

(Anyconnect itself can run scripts, but I don't think it will be of any help, because the functionality would be used for VPN alone)

https://supportforums.cisco.com/t5/aaa-identity-and-nac/ise-and-windows-drive-mapping-scripts/td-p/3031751

Regards,

Octavian

[Mohammed al Baqari]

Yes it can be done. Treat unauthenticated machines as MAB devices and
perform posture part of authorization process. Then they get a dACL which
allows them to map drives only without full access. Full access can be
obtained after authentication.