Post migration from ASA to FTD, macOS users not redirected - AnyConnect

[dgaikwad]

Hi Experts,

Last week we have migrated from ASA to FTD. With no changes in policies or any other configuration on ISE's end. The configuration is good as it is.

Issue:
macOS endpoints are not able to find ISE server

Troubleshooting:
After migration its observed that the Windows endpoints are able to connect to VPN just fine. That is when they connect, policy server is detected and posture scan is run and compliant endpoints are granted access.
But with the macOS endpoints, it observed that authentication works, but they are not able to find the ISE server and run the posture.

These same endpoints were working when we were utilizing ASA for VPN access.
I have tested on macOS Catalina and Big Sur, but the end results is the same.
The VPN policies, client provisioning and authorization policies remain unchanged on ISE.

Has anyone faced this issue? Any pointers?

[Mark Elsen]

 - What is the exact error as seen on the Macs ?      2) Is there any info found in the ftd-anyconnect logs  ?         3) Is there anything in the ISE logs ?

 M.

[dgaikwad]

1. There are no errors reported on the Macs, they just sit there after doing looking for a policy server

2. The things that I checked are, DACL gets applies, I can see that the posture redirection is ACL is also applied and the AnyConnect information is also captured - Is there anything apart from this that I need to collect? Or anything specific that I need to look into.

3. ISE logs show that the correct redirection policy and profiles are applied to the endpoint, there are no errors or anything (this is the same authentication and authorization policies for Windows as well)

[Mark Elsen]

 - It's probably a 'far away shot' , but at least on one Mac I would try to remove Anyconnect , then re-install and see what is the result (?)

 M.

[dgaikwad]

No, uninstall and reinstall has not been tried yet...But will give it a try.
Also, is there anything specific that I shall be looking at the FTD logs?