Configureren 2.2 Clientprovisioning en -toepassing
Inhoud
Inleiding
Dit document beschrijft hoe u Application Visibility on Identity Service Engine (ISE) 2.2 moet configureren en problemen oplossen. Met Application Visibility kunt u toepassingen controleren die op endpoints zijn geïnstalleerd, beleid maken op basis van die informatie en toepassingen doden of verwijderen tijdens posteringcontroles als ze aan gespecificeerde voorwaarden voldoen. AnyConnect stuurt regelmatig informatie naar ISE met een lijst met geïnstalleerde/actieve toepassingen en processen. AnyConnect kan informatie verzamelen over alle toepassingen of over toepassingen uit bepaalde categorieën (browsers, codering, enzovoort).
Voorwaarden
Vereisten
Cisco raadt u aan een basiskennis te hebben van deze onderwerpen:
-
Cisco Identity Service Engine
- Clientprovisioning
- ISE-houding
Gebruikte componenten
De informatie in dit document is gebaseerd op de volgende software- en hardware-versies:
- Cisco Identity Service Engine versie 2.2.0.470
- Cisco AnyConnect 4.4.00243
- AnyConnect-nalevingsmodule 4.2.468.0
- Windows 7-servicepack 1
Configureren
Configuraties
Sectie 1. Clientprovisioning configureren
Stap 1. AnyConnect-pakket uploaden
1. Ga naar Policy > Policy Elements > Results > Client Provisioning > Results on ISE. Klik op Add > Agent resources op de lokale schijf:
2. Selecteer Category als door Cisco meegeleverde pakketten en kies Bestand (AnyConnect-pakket):
Klik op Indienen om de wijzigingen op te slaan.
Stap 2. Nalevingsmodule voor AnyConnect downloaden
Klik op een resultatenpagina van Client Provisioning op Add > Agent resources van Cisco-site, zodat een venster met beschikbare modules wordt weergegeven. Selecteer de gewenste AnyConnect Compliance Module voor Windows en klik op Opslaan.
Stap 3. Houderprofiel maken
Op de Resultaten pagina van Client Provisioning klik op Add > NAC Agent of AnyConnect Posture Profile en selecteer AnyConnect vanuit Posture Agent Profile Settings:
Geef het profiel een naam en vul de vereiste velden in. Klik op Indienen om het profiel op te slaan.
Stap 4. AnyConnect-configuratie maken
Klik op een resultatenpagina van Client Provisioning op Add > AnyConnect Configuration en selecteer het pakket dat in Stap 1 is geüpload:
Er moeten extra opties worden geladen. Vul alle vereiste velden in en klik op Indienen om de wijzigingen op te slaan:
Configuratienaam - naam van de configuratie. Dit wordt gebruikt in het beleid voor clientprovisioning (volgende stap).
Compliance Module - Selecteer compliance module die gedownload werd in Stap 2.
ISE Posture - selecteer AnyConnect Posture Profile dat in Stap 3 is gemaakt.
Stap 5. Beleid voor clientprovisioning configureren
Ga naar Beleid > Clientprovisioning. Maak een nieuw beleid of bewerk een bestaande voor Windows, selecteer de gewenste AnyConnect Configuration als resultaat:
Stap 6. Autorisatieprofiel voor TCP maken
Navigeer naar Beleid > Beleidselementen > Resultaten > Autorisatie > Autorisatieprofielen en klik op Toevoegen om een nieuw profiel te maken. Configureer de optie voor omleiding naar Client Provisioning Portal:
Klik op Indienen om het profiel op te slaan.
Stap 7. Autorisatiebeleid configureren
Navigeer naar Beleid > Autorisatie, maak 2 beleid met controle van Posterstatus:
Met een dergelijke configuratie, als een Endpoint AnyConnect nog niet heeft geïnstalleerd of zijn houding nog niet heeft voltooid, wordt het omgeleid naar de Client Provisioning Portal. De eindgebruiker kan AnyConnect van ISE installeren en AnyConnect kan ISE detecteren en de status controleren.
Klik op Save (Opslaan).
Sectie 2. Positie configureren
Stap 1. Positie bijwerken
Navigeer naar Beheer > Instellingen > Houding > Updates en klik op Nu bijwerken om Houding bij te werken. Het bevat OPSWAT grafieken en definities voor toepassingen en is vereist voor beleidsvorming.
Stap 2. Toepassingsvoorwaarde maken
AnyConnect verzamelt informatie over geïnstalleerde toepassingen alleen met de 4.x (of hoger)-nalevingsmodule.
Met 3.x-versie van de Compliance Module kunnen alleen procescontroles worden uitgevoerd (dit betekent dat AnyConnect controleert of het opgegeven proces al dan niet wordt uitgevoerd).
Met Application State kunnen deze combinaties worden geconfigureerd:
- Geïnstalleerd + actief - AnyConnect verzamelt informatie over momenteel actieve processen en verzamelt informatie over installatie-informatie
- Geïnstalleerd + niet actief - AnyConnect verzamelt alleen installatie-informatie
Met Voorziening door die kan worden geselecteerd: Alles, Naam en Categorie:
- Als Alles is geselecteerd, probeert AnyConnect informatie te verzamelen over alle geïnstalleerde toepassingen
- Als Name is geselecteerd, kan de specifieke applicatie worden geselecteerd voor het beleid. Voorbeeld:
- Als Category is geselecteerd, verzamelt AnyConnect informatie over alle toepassingen uit de opgegeven categorie. Voorbeeld:
Om informatie te verzamelen over geïnstalleerde toepassingen en toepassingen die worden uitgevoerd op Policy > Policy Elements > Conditions > Positie > Application Condition, klikt u op Add om nieuwe voorwaarde te maken en de vereiste velden te vullen zoals getoond:
Stap 3. Posture-vereiste maken
In Policy > Policy Elements > Results > Positie > Requirements creëer nieuwe vereiste met gecreëerde Application Condition:
Stap 4. Posturebeleid maken
Om ISE en AnyConnect in staat te stellen informatie te verzamelen over toepassingen, moet in het Posture Policy een vereiste met een Toepassingsvoorwaarde worden opgenomen. Het beleid van de houding kan bij Beleid > van de houding worden tot stand gebracht. De vereiste kan worden ingesteld als Audit als u informatie wilt verzamelen voor verder gebruik.
Stap 5 (optioneel). Interval van continue bewaking wijzigen
Met ISE kunt u configureren hoe vaak AnyConnect updates over toepassingen naar ISE moet verzenden. Standaard is het interval ingesteld op 5 minuten en kan worden gewijzigd bij Beheer > Instellingen > Houding > Algemene instellingen:
Stap 6 (optioneel). Naleving van app maken
Nadat de gegevens van het Endpoint worden verzameld, kan App Compliance worden gemaakt bij Context Visibility > Endpoints > [ENDPOINT]:
- Selecteer een toepassing:
- Klik op Beleidsacties > App-naleving maken
- Vul de velden in een pop-upvenster in:
- Klik op Beleid opslaan als de items moeten worden gemaakt:
- Houding Toepassingsvoorwaarde
- Handeling voor herstel van posterijen
- Posterisatievereiste
- posterisatiebeleid
Verifiëren
Gebruik deze sectie om te controleren of uw configuratie goed werkt.
LiveLogs
In RADIUS LiveLogs ziet de stroom eruit als een gebruikelijke postuur: Verificatie + omleiding naar provisioningportal > Verandering van autorisatie (CoA) > Overeenkomsten van conforme posterbeleid.
Endpoint
Na de configuratie van de clientprovisioning (als AnyConnect niet eerder is geleverd) en het interval voor continue bewaking kan het proces voor gegevensverzameling worden geverifieerd bij Context Visibility > Endpoints. Klik op het MAC-adres van het eindpunt, de pagina van het eindpunt moet worden geopend. Het bevat informatie over toepassingen die op het eindpunt zelf worden geïnstalleerd:
Posture Policy Elements
Deze elementen moeten worden gecreëerd met de optie App Compliance maken:
- Houding Toepassingsvoorwaarde
- Handeling voor herstel van posterijen
- Posterisatievereiste
- posterisatiebeleid
Elk van hen kan van ISE GUI worden geverifieerd. Voorwaarden bevinden zich op Policy > Policy Elements > Conditions > Positie > Application Condition:
Remediaties bevinden zich op Policy > Policy Elements > Results > Positie > Remediation Actions > Application Remediations:
Vereisten bevinden zich bij Policy > Policy Elements > Results > Positie > Requirements:
Beleid vindt u op Policy > Positie:
Rapporten
Elk Posture-rapport van elk EndPoint wordt opgeslagen op ISE en kan worden gecontroleerd via Operations > Reports. Er zijn twee varianten van Posture rapporten:
- Posture Assessment by Endpoint - het geeft details over posture compliancy voor een bepaald eindpunt.
- Posture Assessment by Condition - het geeft details over de voorwaarden van het posturenbeleid. Het laat zien welke voorwaarden faalden en welke voorwaarden werden vervuld. Alleen de verplichte en optionele voorwaarden worden weergegeven.
Houdbaarheidsbeoordeling per conditie
De beoordeling van de houding door conditie ziet er zoals getoond uit. In dit voorbeeld is een van de verplichte voorwaarden mislukt, zodat de postuur status naar niet-conform gaat:
Standaardevaluatie op eindpunt
Standaardevaluatie op eindpunt:
Details van elke posture check kunnen worden gecontroleerd door te klikken op Details rapport pictogram - 
Problemen oplossen
Deze sectie bevat informatie die u kunt gebruiken om problemen met de configuratie te troubleshooten.
Van ISE
ise-psc.log bevat alle postuur gerelateerde informatie, inclusief debugs. Posture debugs kunnen worden ingeschakeld bij Administration > System > Logging > Debug Log Configuration. component naam is postuur:
Wanneer een eindpunt is verbonden met het netwerk en AnyConnect zich uitstrekt tot de ISE, controleert ISE of EP moet worden gecontroleerd aan de hand van de ingestelde postuur controles en detecteert de versie van de compliance module die op het EP is geïnstalleerd. Op basis van verzamelde informatie genereert ISE posture query voor de EP - NAC agent xml en versleutelt het. Later stuurt ISE deze query naar AnyConnect.
2017-01-04 19:19:13,686 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- About to query posture policy for user cisco with endpoint mac C0-4A-00-15-75-C8
2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureManager -:cisco:::- agentCMVersion=4.2.468.0, agentType=AnyConnect Posture Agent, groupName=OESIS_V4_Agents -> found agent group with displayName=4.x or later
2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- User cisco belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any
2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- About to retrieve posture policy resources for os 7 Enterprise, agent group 4.x or later and identity groups [NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation, NAC Group:NAC:IdentityGroups:Any]
2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by agent group with FQN NAC Group:NAC:AgentGroupRoot:ALL:OESIS_V4_Agents
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- The evaluation result by agent group for resourceId NAC Group:NAC:Posture:PosturePolicies:Apps is Permit
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by OS group with FQN NAC Group:NAC:OsGroupRoot:ALL:WINDOWS_ALL:WINDOWS_7_ALL:WINDOWS_7_ENTERPRISE_ALL
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- stealth mode is 0
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- The evaluation result by os group for resourceId NAC Group:NAC:Posture:PosturePolicies:Apps is Permit
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by Stealth mode NSF group with FQN NAC Group:NAC:StealthModeStandard
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Procesing obligation with posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Found obligation id urn:cisco:cepm:3.3:xacml:response-qualifier for posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Found obligation id PostureReqs for posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps
2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Posture policy resource id Apps has following associated requirements []
2017-01-04 19:19:13,720 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- policy enforcemnt is 2
2017-01-04 19:19:13,720 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- simple condition: [Name=Apps_Collection, Description=null, Application State =installed,runnning, Provision By =Everything, monitory Categories = []]
2017-01-04 19:19:13,720 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- check type is ApplicationVisibility
2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- NAC agent xml <?xml version="1.0" encoding="UTF-8"?><cleanmachines>
<version>ISE: 2.2.0.423</version>
<encryption>0</encryption>
<package>
<id>12</id>
<name>Apps_collection</name>
<description>Apps Check</description>
<version/>
<type>3</type>
<optional>2</optional>
<action>3</action>
<check>
<id>Apps_Collection</id>
<category>12</category>
<type>1202</type>
<monitor>ALL</monitor>
<evaluation>periodic</evaluation>
</check>
<criteria>(Apps_Collection)</criteria>
</package>
</cleanmachines>
2017-01-04 19:19:13,800 INFO [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil - getPosturePolicyHTML [<cleanmachines><version>ISE: 2.2.0.423</version><encryption>0</encryption><package><id>12</id><name>Apps_collection</name><description>Apps Check</description><version/><type>3</type><optional>2</optional><action>3</action><check><id>Apps_Collection</id><category>12</category><type>1202</type><monitor>ALL</monitor><evaluation>periodic</evaluation></check><criteria>(Apps_Collection)</criteria></package></cleanmachines>]
2017-01-04 19:19:13,800 INFO [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil -getPosturePolicyHTML - do encrypt
2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- Encrypting policy using AES key.
2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.CipherUtil -:cisco:::- Encrypting message using AES.
2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- IV Base 64: AeUQGbj6CP/jMB+cTIGIGQ==
2017-01-04 19:19:13,801 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil.getPosturePolicyHTML() returns <!--X-Perfigo-UserKey=--><!--X-Perfigo-Provider=Device Filter--><!--X-Perfigo-UserName=cisco--><!--error=1010--><!--X-Perfigo-DM-Error=1010--><!--user role=--><!--X-Perfigo-OrigRole=--><!--X-Perfigo-DM-Scan-Req=0--><!--X-ISE-IV=AeUQGbj6CP/jMB+cTIGIGQ==--><!--X-Perfigo-DM-Software-List=f5aGq8rU5wx7hFS9WnugNhy/6HaSxNtKesoqAjYkecEk56t+I/J93PtAYU0XLq451NXQhReuFktImYEPEnWwOs1bV5oOTuTsY3kEbcuR4p5Sp0cfz/j98YEubNtSKDCUGt5U8dhpOJqMYTV4UcaSP/D0FXYm10gFEjPxpPghyWcplzYwcpehIX+2vOYOSzPTEvM2kDdHTkof+/UYvBfGv8Y7YkK9P61upfSedIqdynyxUbeqknXkoCaWvUawJLVWiXAJs2atsCwJjXitwNHYzCuH/mBz/Y9AUvbLCB/cutCeyVCl7ij8wtXUAt2NpKqeEj0COOxnp5B35JTBfOSXHfVjL29E5JALaun6RR8yJlkd4apk7qflnjsu451CHY/SbKTMnqjV5bNwXfuCBf++X6X/mh0nwk+r2iWhJJFyqmNxBm2BvcJAJXOKOV7xHIhgmLj+etF4Sss/zwnFT4+WTzKI+BpbrVdnZjUP7+uvbQbIPtRFqJVI5StjZlIP4vLzFWKbWXI+itTX6hjqvNhiT2zwktvIboUZXaBV6yS5/+5cYMU3+EhWxIx/UVo0o7sX--><!--X-Perfigo-DM-Session-Time=240-->
2017-01-04 19:19:13,801 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- User cisco belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any
2017-01-04 19:19:13,801 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- Sending response to endpoint C0-4A-00-15-75-C8 http response [[ <!--X-Perfigo-UserKey=--><!--X-Perfigo-Provider=Device Filter--><!--X-Perfigo-UserName=cisco--><!--error=1010--><!--X-Perfigo-DM-Error=1010--><!--user role=--><!--X-Perfigo-OrigRole=--><!--X-Perfigo-DM-Scan-Req=0--><!--X-ISE-IV=AeUQGbj6CP/jMB+cTIGIGQ==--><!--X-Perfigo-DM-Software-List=f5aGq8rU5wx7hFS9WnugNhy/6HaSxNtKesoqAjYkecEk56t+I/J93PtAYU0XLq451NXQhReuFktImYEPEnWwOs1bV5oOTuTsY3kEbcuR4p5Sp0cfz/j98YEubNtSKDCUGt5U8dhpOJqMYTV4UcaSP/D0FXYm10gFEjPxpPghyWcplzYwcpehIX+2vOYOSzPTEvM2kDdHTkof+/UYvBfGv8Y7YkK9P61upfSedIqdynyxUbeqknXkoCaWvUawJLVWiXAJs2atsCwJjXitwNHYzCuH/mBz/Y9AUvbLCB/cutCeyVCl7ij8wtXUAt2NpKqeEj0COOxnp5B35JTBfOSXHfVjL29E5JALaun6RR8yJlkd4apk7qflnjsu451CHY/SbKTMnqjV5bNwXfuCBf++X6X/mh0nwk+r2iWhJJFyqmNxBm2BvcJAJXOKOV7xHIhgmLj+etF4Sss/zwnFT4+WTzKI+BpbrVdnZjUP7+uvbQbIPtRFqJVI5StjZlIP4vLzFWKbWXI+itTX6hjqvNhiT2zwktvIboUZXaBV6yS5/+5cYMU3+EhWxIx/UVo0o7sX--><!--X-Perfigo-DM-Session-Time=240--> ]]
2017-01-04 19:19:13,959 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- receiving request from client C0:4A:00:15:75:C8 10.62.148.162 bcu5ksw0
2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found the ipAddress that matched the http request remote address 10.62.148.162 and corresponding client mac address C0-4A-00-15-75-C8
2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- looking for Radius session with input values : sessionId: 0a3e946500000066586d3c42, MacAddr: C0-4A-00-15-75-C8, ipAddr: 10.62.148.162
2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- looking for session using session ID: 0a3e946500000066586d3c42, IP addrs: [10.62.148.162], mac Addrs [C0-4A-00-15-75-C8]
2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- Found session using sessionId 0a3e946500000066586d3c42
Het volledige rapport van AnyConnect. Dit rapport bevat informatie over alle gevonden applicaties die overeenkomen met de ingestelde Application Condition.
2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- UDID is 766bb955e51e4ab063fd478c63acee81260ca592 for end point C0-4A-00-15-75-C8 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- os version from user agent is 1.2.1.6.1.4 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Received posture request [parameters: reqtype=, userip=10.62.148.162, clientmac=C0-4A-00-15-75-C8, os=, osVerison=1.2.1.6.1.4, architecture=, provider=, state=, userAgent=Mozilla/4.0 (compatible; WINDOWS; 1.2.1.6.1.4; AnyConnect Posture Agent v.4.4.00209), session_id= 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found a session info for endpoint C0-4A-00-15-75-C8 cisco 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Got userid cisco from cache for endpoint C0-4A-00-15-75-C8/ 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Report IV in Base64: JjneGgZcJbmjqMKQcy8kJg== 2017-01-04 19:19:37,359 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Using AES shared secret to decrypt report. 2017-01-04 19:19:37,359 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.util.CipherUtil -::::- Decrypting message using AES. 2017-01-04 19:19:37,359 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Decrypted report [[ <report><version>1000</version><package><id>12</id><status>1</status><check><chk_id>Apps_Collection</chk_id><diff>0</diff><application><diff>0</diff><id></id><name>Adobe Flash Player 23 NPAPI</name><vendor>Adobe Systems Incorporated</vendor><version>23.0.0.207</version><category>Unclassified</category></application><application><diff>0</diff><id>104</id><name>Adobe Flash Player</name><vendor>Adobe Systems Inc.</vendor><version>23.0.0.207</version><path>C:\Windows\SysWOW64\Macromed\Flash\</path><category>Unclassified</category></application><application><diff>0</diff><id>873</id><name>BitLocker Drive Encryption</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>DiskEncryption</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Diagnostics and Reporting Tool</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\DART\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect ISE Compliance Module</name><vendor>Cisco Systems, Inc</vendor><version>4.2.468.0</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\opswat\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect ISE Posture Module</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path><category>Unclassified</category><process><diff>0</diff><pid>704</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path><hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash></process><process><diff>0</diff><pid>1296</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path><hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash></process><process><diff>0</diff><pid>3076</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path><hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash></process><process><diff>0</diff><pid>3384</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path><hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash></process><process><diff>0</diff><pid>15924</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path><hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash></process></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Profile Editor</name><vendor>Cisco Systems, Inc.</vendor><version>4.1.08005</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Profile Editor\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Secure Mobility Client </name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Secure Mobility Client</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path><category>Unclassified</category><process><diff>0</diff><pid>704</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path><hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash></process><process><diff>0</diff><pid>1296</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path><hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash></process><process><diff>0</diff><pid>3076</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path><hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash></process><process><diff>0</diff><pid>3384</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path><hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash></process><process><diff>0</diff><pid>15924</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path><hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash></process></application><application><diff>0</diff><id></id><name>Cisco NAC Agent </name><vendor>Cisco Systems, Inc.</vendor><version>4.9.5.10</version><path>C:\Program Files (x86)\Cisco\Cisco NAC Agent\</path><category>Unclassified</category><process><diff>0</diff><pid>1444</pid><path>c:\program files (x86)\cisco\cisco nac agent\nacagent.exe</path><hash>502EF2A864254A2DF555E029BE2C39E94B111E8B01534D7161826650DE4CEB4D</hash></process><process><diff>0</diff><pid>2320</pid><path>c:\program files (x86)\cisco\cisco nac agent\nacagentui.exe</path><hash>DC617419F082BEAF26521E48CB410282631F93F1359E604A4D3D181A04FEE1FB</hash></process></application><application><diff>0</diff><id>293</id><name>DAEMON Tools Lite</name><vendor>Disc Soft Ltd</vendor><version>4.49.1.0356</version><path>C:\Program Files (x86)\DAEMON Tools Lite\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Digital Operatives PAINT Beta</name><vendor></vendor><version>0.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>FileZilla Server</name><vendor>FileZilla Project</vendor><version>beta 0.9.44</version><path>C:\Program Files (x86)\FileZilla Server\</path><category>Unclassified</category><process><diff>0</diff><pid>1408</pid><path>c:\program files (x86)\filezilla server\filezilla server.exe</path><hash>E8DB1409DB694A90C759F418346AE5D71014AE3513A8B865B50923AD0DFEE395</hash></process><process><diff>0</diff><pid>2348</pid><path>c:\program files (x86)\filezilla server\filezilla server interface.exe</path><hash>F57B0A7F4A9EBAACC1A67323EBB93D96FA910524FAE842953551DBA103EF71C5</hash></process></application><application><diff>0</diff><id>180</id><name>FileZilla</name><vendor>FileZilla Project</vendor><version>3.8.1.0</version><path>C:\Program Files (x86)\FileZilla FTP Client\</path><category>FileShare</category></application><application><diff>0</diff><id>39</id><name>Google Chrome</name><vendor>Google Inc.</vendor><version>55.0.2883.87</version><path>C:\Program Files (x86)\Google\Chrome\Application\</path><category>AntiPhishing,Browser</category></application><application><diff>0</diff><id></id><name>Google Update Helper</name><vendor>Google Inc.</vendor><version>1.3.24.15</version><category>Unclassified</category></application><application><diff>0</diff><id>100</id><name>Internet Explorer</name><vendor>Microsoft Corporation</vendor><version>11.0.9600.18524</version><path>C:\Program Files\Internet Explorer\</path><category>AntiPhishing,Browser</category></application><application><diff>0</diff><id></id><name>Java 7 Update 79</name><vendor>Oracle</vendor><version>7.0.790</version><path>C:\Program Files (x86)\Java\jre7\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Java 8 Update 91</name><vendor>Oracle Corporation</vendor><version>8.0.910.15</version><path>C:\Program Files (x86)\Java\jre1.8.0_91\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Java Auto Updater</name><vendor>Oracle Corporation</vendor><version>2.8.91.15</version><category>Unclassified</category></application><application><diff>0</diff><id>111</id><name>Java</name><vendor>Oracle Corporation</vendor><version>7.0.790.15</version><path>C:\Program Files (x86)\Java\jre7\bin\</path><category>Unclassified</category></application><application><diff>0</diff><id>111</id><name>Java</name><vendor>Oracle Corporation</vendor><version>8.0.910.15</version><path>C:\Program Files (x86)\Java\jre1.8.0_91\bin\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft .NET Framework 4.6.1</name><vendor>Microsoft Corporation</vendor><version>4.6.01055</version><path>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.6.01055\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Network Monitor 3.4</name><vendor>Microsoft Corporation</vendor><version>3.4.2350.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Network Monitor: NetworkMonitor Parsers 3.4</name><vendor>Microsoft Corporation</vendor><version>3.4.2350.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148</name><vendor>Microsoft Corporation</vendor><version>9.0.30729.4148</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148</name><vendor>Microsoft Corporation</vendor><version>9.0.30729.4148</version><category>Unclassified</category></application><application><diff>0</diff><id>44</id><name>Mozilla Firefox</name><vendor>Mozilla Corporation</vendor><version>47.0.2</version><path>C:\Program Files (x86)\Mozilla Firefox\</path><category>AntiPhishing,Browser</category><process><diff>0</diff><pid>8292</pid><path>c:\program files (x86)\mozilla firefox\firefox.exe</path><hash>47F80E4FC4C43FAF468D94F5D51AAC78A125CC720FCBEA0B88B5F29D06719CE9</hash></process></application><application><diff>0</diff><id></id><name>Mozilla Maintenance Service</name><vendor>Mozilla</vendor><version>47.0.2.6148</version><category>Unclassified</category></application><application><diff>0</diff><id>298</id><name>Notepad++</name><vendor>Notepad++ Team</vendor><version>6.63</version><path>C:\Program Files (x86)\Notepad++\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3122661)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3127233)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3136000v2)</name><vendor>Microsoft Corporation</vendor><version>2</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3142037)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3143693)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3164025)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>TP-LINK TL-WDN3200 Driver</name><vendor>TP-LINK</vendor><version>1.1.0</version><path>C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility and Driver\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Tftpd32 Standalone Edition (remove only)</name><vendor></vendor><version>0.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>VMware Tools</name><vendor>VMware, Inc.</vendor><version>9.4.15.2827462</version><path>C:\Program Files\VMware\VMware Tools\</path><category>Unclassified</category><process><diff>0</diff><pid>952</pid><path>c:\program files\vmware\vmware tools\vmtoolsd.exe</path><hash>5C642EF7F4EF65A0445B2C2CD227F9431835712EE7F1BD4D01D1F7472199DE47</hash></process><process><diff>0</diff><pid>1516</pid><path>c:\program files\vmware\vmware tools\vmtoolsd.exe</path><hash>5C642EF7F4EF65A0445B2C2CD227F9431835712EE7F1BD4D01D1F7472199DE47</hash></process></application><application><diff>0</diff><id></id><name>WinPcap 4.1.3</name><vendor>Riverbed Technology, Inc.</vendor><version>4.1.0.2980</version><category>Unclassified</category></application><application><diff>0</diff><id>300</id><name>WinPcap</name><vendor>Riverbed Technology, Inc.</vendor><version>4.1.0.2980</version><path>C:\Program Files (x86)\WinPcap\</path><category>Unclassified</category></application><application><diff>0</diff><id>923</id><name>Windows Backup and Restore</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>BackupClient</category></application><application><diff>0</diff><id>362</id><name>Windows Defender</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Program Files\Windows Defender\</path><category>AntiMalware</category></application><application><diff>0</diff><id>283</id><name>Windows Firewall</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>FireWall</category></application><application><diff>0</diff><id>1612</id><name>Windows Media Player</name><vendor>Microsoft Corporation</vendor><version>12.0.7601.23517</version><path>C:\Program Files\Windows Media Player\</path><category>Unclassified</category><process><diff>0</diff><pid>1596</pid><path>c:\program files\windows media player\wmpnetwk.exe</path><hash>306467D280E99D0616E839278A4DB5BED684F002AE284C3678CABB5251459CB3</hash></process></application><application><diff>0</diff><id>1587</id><name>Windows Security Health Agent</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>HealthAgent</category></application><application><diff>0</diff><id>1090</id><name>Windows Update Agent</name><vendor>Microsoft Corporation</vendor><version>7.6.7601.19161</version><path>C:\Windows\System32\</path><category>PatchManagement</category></application><application><diff>0</diff><id>1106</id><name>Windows VPN Client</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>VPNClient</category></application><application><diff>0</diff><id>207</id><name>Wireshark</name><vendor>The Wireshark developer community</vendor><version>1.10.7</version><path>C:\Program Files (x86)\Wireshark\</path><category>Unclassified</category></application></check></package></report> ]] ...
Alle rapporten zijn XML-strings. Voorbeeldopgemaakt rapport:
<report> <version>1000</version> <package> <id>12</id> <status>1</status> <check> <chk_id>Apps_Collection</chk_id> <diff>0</diff> <application> <diff>0</diff> <id>104</id> <name>Adobe Flash Player</name> <vendor>Adobe Systems Inc.</vendor> <version>23.0.0.207</version> <path>C:\Windows\SysWOW64\Macromed\Flash\</path> <category>Unclassified</category> </application> ... <application> <diff>0</diff> <id></id> <name>Cisco AnyConnect ISE Posture Module</name> <vendor>Cisco Systems, Inc.</vendor> <version>4.4.00209</version> <path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path> <category>Unclassified</category> <process> <diff>0</diff> <pid>704</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path> <hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash> </process> <process> <diff>0</diff> <pid>1296</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path> <hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash> </process> <process> <diff>0</diff> <pid>3076</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path> <hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash> </process> <process> <diff>0</diff> <pid>3384</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path> <hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash> </process> <process> <diff>0</diff> <pid>15924</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path> <hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash> </process> </application>
... </check> </package> </report>
AnyConnect stuurt volledige rapporten alleen bij de eerste verbinding. Verder stuurt het alleen maar veranderingen. Notepad++ is bijvoorbeeld na enige tijd gestart:
2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Received posture request [parameters: reqtype=, userip=10.62.148.162, clientmac=C0-4A-00-15-75-C8, os=, osVerison=1.2.1.6.1.4, architecture=, provider=, state=, userAgent=Mozilla/4.0 (compatible; WINDOWS; 1.2.1.6.1.4; AnyConnect Posture Agent v.4.4.00209), session_id=
2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found a session info for endpoint C0-4A-00-15-75-C8 cisco
2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Got userid cisco from cache for endpoint C0-4A-00-15-75-C8/
2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Report IV in Base64: JjneGgZcJbmjqMKQcy8kJg==
2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Using AES shared secret to decrypt report.
2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.util.CipherUtil -::::- Decrypting message using AES.
2017-01-04 19:24:37,930 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Decrypted report [[ <report><version>1000</version><package><id>12</id><status>1</status><check><chk_id>Apps_Collection</chk_id><diff>1</diff><application><diff>2</diff><id>298</id>
Notepad++
<vendor>Notepad++ Team</vendor><version>6.63</version><path>C:\Program Files (x86)\Notepad++\</path><category>Unclassified</category><process><diff>0</diff>
16460
<path>c:\program files (x86)\notepad++\notepad++.exe</path><hash>43E9F528CD2405E6DD117857D440A634769C6E11C4D986605354C2605B6E7D84</hash></process></application></check></package></report> ]]
Opgemaakt:
<report>
<version>1000</version>
<package>
<id>12</id>
<status>1</status>
<check>
<chk_id>Apps_Collection</chk_id>
<diff>1</diff>
<application>
<diff>2</diff>
<id>298</id>
Notepad++
<vendor>Notepad++ Team</vendor>
<version>6.63</version>
<path>C:\Program Files (x86)\Notepad++\</path>
<category>Unclassified</category>
<process>
<diff>0</diff>
16460
<path>c:\program files (x86)\notepad++\notepad++.exe</path>
<hash>43E9F528CD2405E6DD117857D440A634769C6E11C4D986605354C2605B6E7D84</hash>
</process>
</application>
</check>
</package>
</report>
Van AnyConnect
Het bestand AnyConnect_ISEPosture.txt bevat alle verwante logbestanden en debugs. Dit bestand is te vinden in DART Bundle verzameld op een endpoint. Hier is een voorbeeld van een periodiek rapport. Het is versleuteld met AES256:
******************************************
Date : 01/04/2017
Time : 19:34:38
Type : Unknown
Source : acise
Description : Function: Authenticator::bldMonitorReport
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 724
Level: info
Monitor Report: &user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1IvCqrVOplj17TAcVXEht8NkDg0OT9jM%2fTNH%2fMKllc0o6Ha5juJo4YtWDWY%2bnOancw%3d%3d.
******************************************
Date : 01/04/2017
Time : 19:34:38
Type : Unknown
Source : acise
Description : Function: Authenticator::buildAndSendHttpMsg
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 196
Level: debug
MSG_SN_HTTP_REQUEST, {{url="https://ise22-pri.example.com:8443/auth/perfigo_validate.jsp"}, {server="ise22-pri.example.com"}, {method="post"}, {object_path=""}, {reuse_existing=1}, {close_when_done=0}, {pkt="&user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1IvCqrVOplj17TAcVXEht8NkDg0OT9jM%2fTNH%2fMKllc0o6Ha5juJo4YtWDWY%2bnOancw%3d%3d"}, {path=""}, {type=1}}.
******************************************
Date : 01/04/2017
Time : 19:34:39
Type : Unknown
Source : acise
Description : Function: HttpHandler::createOutgoingHTTPSMessage
Thread Id: 0xD3C
File: HttpHandler.cpp
Line: 295
Level: debug
MSG_NS_HTTP_RESPONSE, {{success=1}, {pkt="<!--error=0--><!--X-Perfigo-DM-Error=0--><!--X-Perfigo-Monitoring-Interval=5-->"}, {type=1}}.
Veelvoorkomende problemen
AnyConnect kan geen ISE bereiken
In dit geval bevat AnyConnect_ISEPosture.txt fouten:
******************************************
Date : 01/04/2017
Time : 20:04:40
Type : Unknown
Source : acise
Description : Function: Authenticator::buildAndSendHttpMsg
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 196
Level: debug
MSG_SN_HTTP_REQUEST, {{url="https://ise22-pri.example.com:8443/auth/perfigo_validate.jsp"}, {server="ise22-pri.example.com"}, {method="post"}, {object_path=""}, {reuse_existing=1}, {close_when_done=0}, {pkt="&user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1Pdu7AztTn%2f3VYph9WNF1jGljXSuTFmr38e%2bvDXQnx7avYHs9meVItYqA6MecAJK3WdkBNSrK1bYjmIvzkAPqR2LuoflnA9IcNOTZQ9iN%2fknOjlLqsiV5eV6jlMSUeOakKsTwy1gbPsFz99eKdtaCMv1F%2fsAmvLApjpke0IMKorXXkvpJURtAtOMK75ltXdykC85ihgHcI10JW7mlpvIppk5MbCZjihQbXldr5%2fQVdpB8eRqMHF1iCK1gx96lwwdzBSfr%2bgrcF4072fYYNOa9cYnTFShgU%2bxrnBDcJ1GUoYE9K5nTfGQ01p4NrcbLjpM79e14v14YgfQhmSfktwxfA8pY7A6jmL3BIp3O9gmQVnoTqaaccqkW76uT%2bPkjVOyrOgdG0CYwUwUMVqpctGKorxx1C3IwXhBWUmvRY9p2LRdePRqnCN8hpiesyk%2bzTnyX0OaNdHD6%2bGEMGo9QjQvwrL9dcvrUxxHtlQcJPekXajXPfn98FpC8z%2b966tcz4DfMN6giSlEfK6y5%2bMpk0oAL%2fV4XMg296PDocGaeTK1OUR7Qkl%2b7S2fv%2fCfZdiQaTndZ6zHWuimq5JBRElmuKI9hWRN2cPERcDn64ISZZSiz9yPoJPlPPpFsfggkc2PdS0OEEtMiM%2bBjNKcFx2Tcsq76eYfDtvDq9tGzjST8opInlIiXdAzdbeWsjCAerCvS73xg2vd2DHfpFlrd5lVa3qwo3Vov3nFiAz4l3IrI1fOHjAE7rCZTy2dWU455icOjmO%2bCVAS3SzWCea4fZu3fAhmIhAVQKE1cFZ4CyyBv8934OVw62Bxu5ij0wbHOStA8TSbxJXyuGBw8cqTPfuUtqPLx6nWtcRZ6p13MuQTq%2bKZLZ7hwY2Urf1o1Gi9OPGyo5zuJZAuQInU%2bkJKU6ycXHZo17Uti3DITCy0%2fG%2bQ2gixzBIpmJctekKJO243rZiU1wbOUPWLzGum8ydRu3im2LiDisXquAu7ipY5P0D475AZN3Cd6nlIPP5MOra493QhX4Il39q%2birT1%2f5F7tI%2fKLv20fWFC%2fjKbfu%2bFe4QIbdtiSCvLkyZ%2bWDwBMWSXHGE11CoErbj4LJP3h4oqLto17riGCYMb%2bRHZXNJA2bwjcfgY4w2FE4hrL0cC6D3YgZxHHpUeT4gMXoXj0EJwODxQwElc9yfoe%2bDgJ4Fy6%2fXc0ymDFYU7oOouAc0nwPKZwhZn4Q3mMZIG5aeOFcx9IM6M47IcMMbo0r78aUk8M94h5f4sK6JxHz75B6JyTx3H%2bxFDJ3j5UtUYj1oir4CLQJgR8ABhMDGxqhAN4c4wA4y790bh2F5PxkVXMGYb4ghFNt3jIHGXRMENPTYkelnD0fa1mMmhJUXE%2fVAshJ8aZwcGCU%2fNhSkCATRXb5UDAmeaSkwe3m4bcRtfBbNZ1l5CNQVH8ZPZsKlGCNpD6dOYkSxa%2ffErYqImEzm9itwSzUujQXI%2f8%2f%2fKewc9jeBujwHqnjuIYg5sJbjk%2bqc%2fwy5hKHTbxFacnFJlgvJhHt3mht8oRC9EbbsULoAK1fvLe4%2fE%2bqFjOe02bw4sQuu1ssMKxLsNQMCTIZFzhl0K6BZdfo1RonKG0MEG1K%2ftSDNC4eyQw9ewYhgpozDVHW1yprpVY9UgcTvFVSh0Vy%2bWde4b0dtmPdhbQhvvsQOSgnxIX6a8GN4AwXEoE7CoP6%2fFZiTAJTuxUKMjC1m8iAsrAurJugnEgaKKugSNkl9y7bgSiYB6zkthDclEyBFWc1rAEcfH6oMJs59aJodXnPSAA9FuyqLCWB%2f3WFZ03efhTviz2101G8%2fsWMxR0w%2fR56oNH2wzUwkmh9oczFaYLpJPzg6k47oh1zmDJraqyvWgzzfPIipa7EKK8YvsuO4BCFgMrDZtYZnCO6B9CFoKDCNJE9Wxl%2bhTdzFCA4GpeLE4nT7y1j113iTV%2faWyImNLaRMU2ZiwuKy%2bd2OH55LqnLBCxrUUIMH7Ku4Mhd%2fYvw1NVpcZZ0L%2bWOkMoephk2XXE4OQAY7Rk%2f%2fRnCbbHlFOVQmEVOoxNneBElleajK%2fxX6C0BZBaebAVYluwdGkkktvgQ5gUvzMiyqbsvzyUMzq%2fhqKY7vVMWUeyCsBnybuGPSILJIkMgdgjiz%2baUZsOyZsUE%2b7PPyiqphqXNRfQ6tj8wTzq7a2Z5XgCYI10Piqj1mg6hY1TiRYuPanyBqh61LFKxblkpQJX2339pqB4RBOzF4%2f3CsvfjU302NSU9fypX5dBYubAZt80DOBe84FSnQIX3pfX2%2fW9LqclyWbxC2QSOfHoe6TgkCiOall%2fqUHWqeOogbgLO5s5ffBoNmUCxhJW%2fH1EqKcsFzA%2ba%2f2Q0%2bs2m99Rqlxdd55bg67LXVPGfKh2dbVHjghXjO90nLEtVwCfs8oMUIg%2bmnip%2fdA7wDz4Nsma2W0ugEhOjpfFbL2TxHLhE0r%2bwy3t%2bosvtaXNJZg84LJKpt3J%2bmc0pnIBH5S5H7zrNDKUnIYXY8BD5n1clZi4wwkRIp62avJw7lN22zNHsjp7NUjTYw9X%2f1Iti1TKxjPZuitU%2bITeCRRHzeoaeGbzE1E%2bGSSqemw7F1wx4w9JXHDajH%2bY4iX7z2Y4OrY1JQQleeS9KWzw5HdiCpuHmhMtLMSpz%2fGagw7KeaLEe9FxwrOYILS%2fXuBStZ1XOpbQHIlH0ZdQbv2I%2bA%2f3j3GvalSul%2f0YVWlPPPIC2OgkSSbd4HyXXh9TEB8dhDmfucy5VEZ5MsuOTgytkALNSK0t9cyvsAcWTQf0uVAMnyBeaMPJAvdE9fXUiH628eMD9PHvt3cL0GYdRR9WBUcszIFtJNIA5AXj7abdbc6VZ8DqX4YfJ1xgTqg2qKSJqXvtbi5BJU49BGaxu01Ta6eBo2ABLtgBxKzb8DYNYqyqRB%2bYkgr5YdU6z6va15jQJYGUJYVwZ8xDsKvYHz1fUFAHldzxkq44myNAjD1H0DoYhQaXUl20UXkgO9w5kBqTfmKj9DOJhs5Q88ilebAbHHxm3GTZSJpP51jQjsPSUi3doX3Mz8E7W5pYptxtW1XPwcSHhkxuhWjbVKKQRTgM5uSXCPQ0PDAqcc6NybV2t1BK3GhQSPzsQ5k3wkldK7CYuUWMpKTMNLZDVF8i25DoGpA0K5m5s3VMAukLA9Gob5ysU%2fsu2TVBrJZDOsa3L%2bNoF2b01f8BC32e.
******************************************
Date : 01/04/2017
Time : 20:04:41
Type : Unknown
Source : acise
Description : Function: hs_transport_winhttp_post
Thread Id: 0xD3C
File: hs_transport_winhttp.c
Line: 5776
Level: debug
unable to send request: 12029.
******************************************
Date : 01/04/2017
Time : 20:04:41
Type : Unknown
Source : acise
Description : Function: HttpHandler::createOutgoingHTTPSMessage
Thread Id: 0xD3C
File: HttpHandler.cpp
Line: 295
Level: debug
MSG_NS_HTTP_RESPONSE, {{success=0}, {pkt=""}, {type=1}}.
******************************************
Date : 01/04/2017
Time : 20:04:41
Type : Error
Source : acise
Description : Function: Authenticator::parsePostureData
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 257
Level: error
Failed to communicate with CAS..
******************************************
Date : 01/04/2017
Time : 20:04:41
Type : Error
Source : acise
Description : Function: SMNavPosture::SMP_handleMonitorResp
Thread Id: 0xD3C
File: SMNavPosture.cpp
Line: 495
Level: error
Failed to parse monitor response.
*****************************************
ISE geeft "null"-fout bij het maken van App Compliance vanuit EP-weergave
De meest voorkomende reden om een "null"-bericht te hebben tijdens het maken van App Compliance vanuit de weergave van het EP is het ontbreken van de vereiste OPSWAT-kaarten. Posture Update naar de meest recente versie zou dit probleem moeten oplossen.
Revisiegeschiedenis
| Revisie | Publicatiedatum | Opmerkingen |
|---|---|---|
1.0 |
31-Mar-2017 |
Eerste vrijgave |
FeedbackContact Cisco
- Een ondersteuningscase openen
- (Vereist een Cisco-servicecontract)