I had the same issue with a similar set up. The outside user (and me as a test outside) had a older version of Anyconnect Secure Mobility than ISE has installed to push to internal users for VPN. When trying to get the Anyconnect Compliance Module added on from ISE, it first wanted to update the Anyconnect Secure Mobility Client (VPN) and blocked it for some reason. I uploaded the latest Anyconnect webdeploy pkg to the ASA so that would be installed first for outside users trying to get in. (Or they could do it manually if they have access to Cisco software I suppose) Having the latest Anyconnect Secure Mobility Client then didn't require updates when VPNing in and was able to get the Compliance Module downloaded.
... View more
