I am working with customer for ISE posture deployment. Customer used powershell to deploy anyconnect ise posture module for windows and Mac. I go through anyconnect deployment document and find that we need edit ACTransforms.xml file to customize which anyconnect components would be installed on mac. The XML file has this format: <ACTransforms> <PropertyName1>Value</PropertyName1> <PropertyName2>Value</PropertyName2> </ACTransforms> But there is no more detail on how to define PropertyName and Value. So if we only install ise posture module, how can I edit this file? ... View more

Hi, Since AnyConnect ISE posture is the agent for compliance check, so it is important that process/service of this posture module  is not allowed to kill/stop by users. I know we may rely on AD user permission so that normal AD users have not enough permission to do that. But besides that, is there a way to make it by the setting of AnyConnect itself, not rely on AD permission. I found below possible solution of windows lockdown. But it does not explicitly mention that if ISE posture module supports lockdown. 1. Has anyone made it before?  If we are able to use setting windows lockdown for ise posture module, could anyone provide details of how to do that(probably a Microsoft guide) 2. What is the cisco recommended solution for this requirement? Setting Windows Lockdown—Cisco recommends that end users be given limited rights to the Cisco AnyConnect Secure Mobility Client on their device. If an end user warrants additional rights, installers can provide a lockdown capability that prevents users and local administrators from switching off or stopping the AnyConnect services. You can also stop the services from the command prompt with the service password. The MSI installers for VPN, Network Access Manager, Web Security, Network Visibility Module, and Umbrella Roaming Security Module support a common property (LOCKDOWN). When LOCKDOWN is set to a non-zero value, Windows service(s) associated with that installer cannot be controlled by users or local administrators on the endpoint device. We recommend using the sample transform that we provide to set this property, and apply the transform to each MSI installer that you want to have locked down. You can download the sample transforms from the Cisco AnyConnect Secure Mobility Client software download page. many thanks in advance. ... View more

Hello, I got some questions from customer about FMC signature update( local malware analysis and file preclassification signature updates) . What I could find in document about this signature update is that, by default, automatic update is enable and FMC checks for signature updates once every 30 minutes. But questions are related to very detailed process and I am very appreciated if I could get answer of below questions. Can FMC manually update the signature? What is the best practice of signature update? Is there any Portal or Mail services to notify the customer for when/what signature applied? How can we exclude the specific signature on FirePower to be applied What is frequency of signature update, do we have any statistics for signature update frequency? br, Martin ... View more