Is that behaviour documented anywhere? I have labbed it up, where I denied TCP traffic on the dACL and allowed UDP, and redirection stopped working. ... View more

I am confused. Are you suggesting that if traffic is hitting "permit" in the redirection ACL, then the dACL is ignored? ... View more

Thank you all for your answers. At the end, it looks like the only way for a fresh install of AnyConnect (where ISE addresses are not known yet) to be redirected with the above dACL, is to try and access enroll.cisco.com. Otherwise, the above dACL will block any other access I wonder what HTTP GET to default-gateway:80 is there for? Who would allow this on their dACL? ... View more

Are you sure about dACL has no implicit deny?!?! I just tested it, without posture, and dACL has implicit deny. In the dACL I allowed access to only one host and any other host was denied. So back to my original question: Assuming your dACL and redirect ACL are in place and assuming there is explicit deny, what would a fresh install of NAC agent will send over the wire? ... View more

So if redirect is happening then the dACL is ignored? ... View more

WOW, thanks for the detailed response. I tried that in the lab. I noticed how the Session ID in the redirection correlates to "Audit Session ID". But step 4 did not work! I had to explicitly send the HTTP GET to ISE:80. Please noticed that in the redirection ACL, I allowed HTTP traffic to ISE server not to be redirected: deny tcp any host <ise_ip_address> eq www. Then ISE itself redirected me to /admin:443 and then the switch redirected me to the portal. With your example, if the first GET to cisco.com:80 will not reach the ISE HTTP probe and will never get profiled. All ISE will see is traffic on port 8443. With my example, where I allow traffic to ISE on port 80, and deny the redirection to ISE server on that port, then ISE HTTP probe would get the clear text GET with my special User-Agent. Now I have tested this without redirection. Right after dot1x login, I send the wget -U myUserAgnet to ise:80. Got 302, and then few more redirections to /admin:443. And I was profiled correctly! Now I have made another test. I moved the ubuntu to another port, and noticed that the live session was "Terminated". Then I tried wget again, and the profile did not change. So for now, my conclusions for being able to purporsly change the User-Agent reported by the Endpoint Identity  are: The Ubuntu IP address have to be listed under the Live Sessions, and not be in a  "Terminated" state. The Ubuntu should send the crafted wget -U myUserAgnet to ISE:80. Now I sill wonder why it didn't worked in ISE version 1.3, and I wonder if this will work in 2.0 and future versions. ... View more

At this point, I do not care about redirection. What I am trying to do is to "feed" ISE with a custom user agent. Here is the follow I want to establish: 1. Create a profile condition on ISE which matches the following user agent : "myUserAgent" 2. Create a profile "myProfile" that matches the above and set the Certainty Factor to 100 3. Create authorization rule that matches the above "myProfile" and allow that workstations in the "myProfile" device group. Such workstations will be allowed in, no matter what their posture is. Now I need to find a way to make ISE to act upon HTTP request, with User-Agnet="myUSerAgent", so ISE would profile it as "myProfile". The way I was doing this was running a "wget -U myUserAgent < protocol >://<ise address> > /dev/null". This script will send HTTP GET to <ise address> with User-Agent="myUserAgent". When trying this on ISE version 1.4, It was successful with protocol=http : wget -U myUSerAgent http://<ise address>". It did not work with protocol=https or https+port 8905. For ISE version 1.3, nothig worked. I verified with TCPDUMP on the ISE server that the above user agent did get to ISE1.3, but ISE1.3 had no reaction to this, and did not profiled the client to be "myProfile". Now I don't really care about 1.3. I need this to work on 1.4 and on any future ISE release. So here is my question: Would ISE ALWAYS, for ever and ever, inspect HTTP on port 80 to look for IP:User-Agent profile condition, or maybe I was just lucky and I shouldn't count on it? ... View more

What would be the destination IP address of the first HTTP(S) packet that the posture client sends? EDIT: Maybe I should have also asked this: What is the order of operation on incoming packet to the switch? dACL -> WEB_redirec_ACL or is it WEB_Redirect_acl and only if its a deny, then dACL? ... View more

Something still bothers me... How would the client get to the default gateway if the posture dACL denies access to anything other than DCHP/DNS/ISE and/or maybe non-RFC1918 addresses? ... View more

Hi Thomas, Thanks for the answer. I am trying to run a script on ubuntu, to send HTTP GET to ISE with a custome user agent.  Than I match it with a customer profile. It will be my own little posture check for unix machines. With version 1.4 I noticed that onlt "wget -U myAgent ...." to port 80 works. No other port will set the user agent (8443/ 8905...) With version 1.3, where I need this feature the most, ISE ignores the user agent no matter what. Is theer a way to verify when exactly ISE will actually inspect the user agent, and when it would not? Also, how do I troubleshoot profiling? Can I start a debug on a probe? -Dan ... View more

What is a "discovery host"? Is that a PSN? ... View more

If I'll "hard code" the PSN in the client profile, when would the agent try to connect to the PSN? Would the agent wait for redirection? Or any other trigger to cause the agent to contact the PSN? ... View more

Thanks Tim, Can it be changed? ... View more