Hi, If you aren't using a routing protocol to redistribute those VPN routes then it probably isn't necessary - it's just creating static routes for each VPN network, but doing nothing with them. If you had a redundant configuration and using routing to failover it would be useful. HTH ... View more

Hi, Upon first connection the user's computer will be in a posture unknown state, the user will be authenticated and authorized and received an IP address from the VPN Pool. Normally you would restrict access by using a DACL (providing access to ISE, ICMP and DNS) in order for the posture checks to be run. Upon successful posturing, the state would change to compliant at which point a CoA (change of authorization) is sent and the user is re-authorized, providing full access.   ISE Posturing can check for Anti-Virus, Anti-Malware, OS, Hotfix, Personal Firewall etc. If posturing is sucessful then full access is granted, if un-sucessful the device can be quarantined, restricting access.   If you want only your domain computers to connect to the VPN, then you can use double authentication on the FW (I assume ASA). You can user certificates issued from your Internal CA (which only your domain computers trust) for the first authentication, this will be mutually authenticated between the VPN client and the ASA. The 2nd authentication will be RADIUS to ISE.   No you don't need Hostscan.   HTH ... View more

Ok, the problem is your dynamic NAT rule (rule number 2) is above the nat exemption rule you have defined between APDO and POM (rule number 8). Therefore the traffic is being natted behind the outside interface.   2 (Inside) to (Outside) source dynamic any interface translate_hits = 15695867, untranslate_hits = 2052342 | | 8 (Inside) to (Outside) source static APDO APDO destination static POMS POMS no-proxy-arp route-lookup translate_hits = 0, untranslate_hits = 0   Move the dynamic rule to Manual NAT Section 3 (after-auto)   HTH ... View more

Hi, If you aren't changing the Crypto Map configuration then you can apply this to another interface, nothing will happen until traffic is routed out that interface. ... View more