[ISE] Posture Status - Not applicable

[Patrick Tran]

Hi,

I configured WiFi Guest Access with WLC and ISE and it works great.

Now I want to check client posture.

I configured a posture policy

On Windows7 client, I installed NAC client. With network sniffer, I can see SWISS protocol (TCP 8905) between client and ISE.

In authentications log, Posture Status is always "NotApplicable"

Why is this posture not applicable?

Thanks a lot!

Patrick

[vrz rrr]

kylerossd,

does not work. Thoses confs are not good.

V.

[kylerossd]

I resolved my issue. I created a client agent profile and assigned agent version in client provisioning. Even though i didn't hAve to it seemed to help. It also appears that Symantec endpoint 11 causes issues, if you clean list the nac agent folder in Symantec endpoint protection the agent loads MUCH faster.

Sent from Cisco Technical Support iPhone App

[bhthapa]

I recommend you to first Verify/Create posture requirements

Policy > Policy Elements > Results > Posture > Requirements

The conditions are defined in the following location: Policy > Policy  Elements > Conditions > Posture.

You also need to open these ports for the same

permit tcp any host 80.0.80.2 eq 8905 --> This is for posture  communication between NAC agent and ISE (Swiss ports)

permit udp any host 80.0.80.2 eq 8905 --> This is for posture  communication between NAC agent and ISE (Swiss ports)

permit udp any host 80.0.80.2 eq 8906 --> This is for posture   communication between NAC agent and ISE (Swiss ports)

[vrz rrr]

Hi Bhaskar,

that's a good point.

Now could you please give us the right posture ACL to be downloaded to the Switch (or set on a WLC). I think that some procotols are missing....

Regards.

V.

[bhthapa]

Here are some ports which needs to be open please use these

permit tcp any host 80.0.80.2 eq 443 (This is for URL redirect)

permit tcp any host 80.0.80.2 eq www

permit udp any host 80.0.80.2 eq 8905 (This is for posture communication between NAC agent and ISE (Swiss ports))

permit udp any host 80.0.80.2 eq 8906 ( This is for posture communication between NAC agent and ISE (Swiss ports))

permit tcp any host 80.0.80.2 eq 8443 (This is for guest portal port)

permit tcp any host 80.0.80.2 eq 8905 (This is for posture communication between NAC agent and ISE (Swiss ports))

deny ip any any