That was it Fahim. Thanks.

I had the same issue with a similar set up.  The outside user (and me as a test outside) had a older version of Anyconnect Secure Mobility than ISE has installed to push to internal users for VPN.  When trying to get the Anyconnect Compliance Module ...

For computers that haven't had the patch installed, will AMP for Endpoints protect from the Meltdown and Spectre Intel chip flaw?      

My fix was turning on the Windows Firewall during the install.