Hi Josh,   ISE 2.6+ does support consuming the UDID from the VPN connection using AnyConnect 4.7+ and using that in the query sent to the MDM for compliance status. The UDID value for the endpoint would also need to be an attribute supported and known by the MDM solution, but I'm not sure what version of JAMF Pro is required for this. You would also likely need to enroll (or re-enroll) the device with JAMF after installing AnyConnect so the UDID attribute is associated with the endpoint. I would suggest confirming that your JAMF instance supports the UDID attribute and has learned that attribute for the endpoint you're testing. You can also Expose the UDID in DART to confirm it matches that attribute in JAMF. If the attribute is associated with the endpoint in JAMF and you're still having issues, you will likely need to open a TAC case to investigate further via debug logs.   Cheers, Greg ... View more

With the newer IOS-XE code, you should be using the SISF-based Device Tracking feature as shown in the ISE Secure Wired Access Prescriptive Deployment Guide. I can't tell from your configuration  snippet, but it doesn't look like this is configured. If you haven't done so, try using the following configuration example: Sw(config)#device-tracking policy IPDT_POLICY Sw(config-device-tracking)#tracking enable Sw(config-device-tracking)#no protocol udp ! interface GigabitEthernet x/y/z device-tracking attach-policy IPDT_POLICY ... View more

If you're booting to the ISE 2.6 ISO for the password recovery, this error typically indicates that it cannot properly detect the disk. If you have not done so already, verify that the ISO is not corrupt by checking the MD5. If this is a VM, ensure you have the correct VM specs as per the ISE 2.6 Install Guide and the the Disk Controller type has not been changed. If all else fails, you will likely have to try re-imaging the appliance from the ISO (or re-deploying from the OVA) and restoring the configuration from backup. ... View more

If this is only happening in the one location, I would suspect something on the router is causing the problem. If your VPN connection is using IPSec, verify that the router supports some sort of IPSec Passthrough or try using SSL VPN (if the option is available). Look for any other settings on the router that could affect IPSec or SSL traffic and check if the ISP has any restrictions on such traffic. ... View more

AFAIK, Phantom mainly uses the REST API to communicate with ISE. There is some pxGrid capability available in the Splunk Add-On for ISE (as per Identity Services Engine and Splunk pxGrid Configuration Guide), but these would likely be utilised for different use cases. For these functions, the Base and Plus (REST API, pxGrid, and ANC) licenses should suffice.   If the customer wants to leverage MS SCCM integration to check Compliance of Windows endpoints, this would leverage the MDM/DDM integration. For that, the Apex license would be required.   Cheers, Greg ... View more