I have the same problem with 2.2p5. Has anyone heard from Cisco on how to handle this? Cheers ... View more

Is it being profiled as an android? If yes, create an authz policy to place it on the network with an authz profile that does not redirect to cpp. Place this authz policy above the one for windoze posture assessment. Sent from Cisco Technical Support Android App ... View more

Hmmm... OK, this may be our answer: Doesn't work: ip access-list extended ACL-POSTURE-REDIRECT deny ip any host 10.10.10.238 deny ip any host 10.10.10.239 deny udp any any permit tcp any any eq www permit tcp any any eq 443 permit tcp any any eq 8443 Try this: ip access-list extended ACL-POSTURE-REDIRECT deny udp any any eq domain deny udp any host 10.10.10.238 eq 8905 8906 deny tcp any host 10.10.10.239 eq 8443 8905 deny udp any host 10.10.10.238 eq 8905 8906 deny tcp any host 10.10.10.239 eq 8443 8905 permit ip any any Reasoning: Since, in the original access list, you are allowing the port 80 discovery packet to reach the ISE servers without redirect, the NAC agent does not learn the actual address of the answering ISE server (ISE2) via the 302 redirect message (it is never triggered) but uses the programmed address of ISE1 instead. This also explains why it does work when you program the address of the second ISE in the NAC agent (still no 302 redirect message, but the agent tries both ISE servers). In the second access list, you are allowing SWISS traffic (and 8443) to bypass the redirect, but forcing the port 80 traffic to trigger the redirect message. Cheers ... View more

Hi, One note on this. There appears to be a limit to the number of characters that you can enter in the Posture Agent Profile, Discovery Host field. When I attempt to enter the fqdn of both PDPs as : xyz-hqs-isepdp1.xyzhqs.com; xyz-hqs-isepdp2.xyzhqs.com it is truncated to: xyz-hqs-isepdp1.xyzhqs.com;xyz-hqs-isepdp2.xyzhqs. It appears that the limit is 50 characters. Cheers, Greg ... View more