Issues on posture enabled SSID

[hdshamal26]

Hi,

We have one posture enabled SSID in our wireless network. It is not seamlessly work compared to other SSIDs. The main difference is posture feature has enabled on it. Below are the list of issues. Please share your experiences to overcome from these issues.

1. Globe icon is not changed to the WIFI icon soon after user connected to the SSID. It will take time to change the icon after the posture process completed. Though the icon doesn't change user has access to the network (Both intranet & internet via proxy)

2. Connected to the SSID. But "No internet" massage appeared. At this time no internet access even after ore than 5 minutes.

3. "Action Needed" when user connected to the SSID it prompt "Action Needed for <SSID name>". Though this is appeared some times user have access to the network. Some times not.

4. Users are experiencing sudden disconnection from the SSID.

[marce1000]

 - You can for instance  , check the ISE live logs when a client connects and then verify if according to posture sequence executed , that access is granted or rejected, 

 M.

[srimal99]

You can check the radius  live logs, and check against the authorization rule are matching accordingly.I have had similar issue anyconnect not joined but ise logs shows client connected.
There are some cisco ISE videos below for your reference;
https://www.youtube.com/watch?v=AxgtXynug_E
https://www.youtube.com/watch?v=14ozZzOE_zM

[Rich R]

Not enough detail provided to say for certain but I'd guess this is related to radius CoA not reaching the WLC or not being allowed.
Have you enabled CoA and allowed it through ACLs and Firewalls?
In wireless profile policy "aaa-override"
"aaa server radius dynamic-author" must include all your radius server(s)
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113344-cuwn-ppm.html#toc-hId--1639616132

Source Device	Destination Device	Protocol	Destination Port	Source Port	Description
RADIUS server	WLC	UDP	1700	0::65535	CoA radius packets