Configure 2.2 Client Provisioning and Application

Available Languages

Updated:November 20, 2017

Document ID:210514

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

Prerequisites

Requirements

Components Used

Configure

Configurations

Section 1. Configure Client Provisioning

Step 1. Upload AnyConnect Package

Step 2. Download AnyConnect Compliance Module

Step 3. Create Posture profile

Step 4. Create AnyConnect Configuration

Step 5. Configure Client Provisioning Policies

Step 6. Create Authorization Profile for CP

Step 7. Configure Authorization Policies

Section 2. Configure Posture

Step 1. Update Posture

Step 2. Create Application Condition

Step 3. Create Posture Requirement

Step 4. Create Posture Policy

Step 5 (Optional). Change Continuous Monitoring Interval

Step 6 (Optional). Create App Compliance

Verify

LiveLogs

Endpoint

Posture Policy Elements

Reports

Posture Assessment by Condition

Posture Assessment by Endpoint

Troubleshoot

From ISE

From AnyConnect

Common issues

AnyConnect cannot reach ISE

ISE throws "null" error when creating App Compliance from EP view

Introduction

This document describes how to configure and troubleshoot Application Visibility on Identity Service Engine (ISE) 2.2. Application Visibility allows you to monitor applications installed on endpoints, create policies based on that information and kill or uninstall applications during posture checks if they meet specified conditions. AnyConnect periodically sends information to ISE with a list of installed/running applications and processes. AnyConnect can collect information about all applications or about applications from specified categories (browsers, encryption, etc.).

Prerequisites

Requirements

Cisco recommends that you have basic knowledge of these topics:

Cisco Identity Service Engine
Client Provisioning
ISE Posture

Components Used

The information in this document is based on these software and hardware versions:

Cisco Identity Service Engine version 2.2.0.470
Cisco AnyConnect 4.4.00243
AnyConnect Compliance Module 4.2.468.0
Windows 7 Service Pack 1

Configure

Configurations

Section 1. Configure Client Provisioning

Step 1. Upload AnyConnect Package

1. Navigate to Policy > Policy Elements > Results > Client Provisioning > Results on ISE. Click Add > Agent resources from local disk:

2. Select Category as Cisco Provided Packages and Choose File (AnyConnect package):

Click Submit to save changes.

You should be asked to confirm checksums of uploaded package. Compare them with checksums provided on a Cisco website to ensure that the package is not corrupted.

Step 2. Download AnyConnect Compliance Module

On a Results page of Client Provisioning click Add > Agent resources from Cisco site, so that a window with available modules pops up. Select required AnyConnect Compliance Module for Windows and click Save.

Alternatively if you do not have an Internet connection on your ISE you can download the latest Compliance Module from cisco.com and upload it to your ISE in the same way as AnyConnect package.

If you have a proxy in your network, configure it at Administration > System > Settings > Proxy page.

Step 3. Create Posture profile

On the Results page of Client Provisioning click Add > NAC Agent or AnyConnect Posture Profile and select AnyConnect from Posture Agent Profile Settings:

Name the profile and fill required fields. Click Submit to save profile.

Step 4. Create AnyConnect Configuration

On a Results page of Client Provisioning click Add > AnyConnect Configuration and select package which was uploaded in Step 1:

Additional options should be loaded. Fill all required fields and click Submit to save changes:

Configuration Name - name of the configuration. This is used in Client Provisioning policy (next step).

Compliance Module - selct compliance module which was downloaded in Step 2.

ISE Posture - select AnyConnect Posture Profile which was created in Step 3.

Step 5. Configure Client Provisioning Policies

Navigate to Policy > Client Provisioning. Create new policy or edit an existing one for Windows, select created AnyConnect Configuration as a result:

Step 6. Create Authorization Profile for CP

Navigate to Policy > Policy Elements > Results > Authorization > Authorization Profiles and click Add to create a new profile. Configure it for redirection to Client Provisioning Portal:

Click Submit to save the profile.

Keep in mind that redirect-acl (in this example its called ISE-REDIRECT) should be created on NAD (Network Access Device) to have proper redirection. Basic redirect ACL should not intercept traffic to and from ISE PSN nodes, DNS and DHCP. And should redirect HTTP and HTTPS traffic. Sample ACLs can be found in these documents: Central Web Authentication on the WLC and ISE Configuration Example and Central Web Authentication with a Switch and Identity Services Engine Configuration Example

Step 7. Configure Authorization Policies

Navigate to Policy > Authorization, create 2 policies with check of Posture status:

With such configuration, if an Endpoint does not have AnyConnect installed or did not finish posture yet, it is redirected to Client Provisioning Portal. End user can install AnyConnect from ISE and AnyConnect can detect ISE and check posture.

Click Save.

Section 2. Configure Posture

Step 1. Update Posture

Navigate to Administration > Settings > Posture > Updates and click Update Now to update Posture. It contains OPSWAT charts and definitions for applications and is required for policies creation.

Alternatively if you do not have an Internet connection on your ISE you can download the latest posture updates from https://www.cisco.com/web/secure/pmbu/posture-offline.html then navigate to Administration > System > Settings > Posture > Updates, select Offline and select downloaded file with posture updates. Click Update Now to upload the file and install posture updates.

Step 2. Create Application Condition

AnyConnect collects information about installed applications only with 4.x (or later) Compliance Module.

With 3.x version of Compliance Module only process checks can be performed (it means that AnyConnect checks if specified process is running or not).

With Application State those combinations can be configured:

Installed + Running - AnyConnect collects information about currently running processes togather with installation information
Installed + not Running - AnyConnect collects only installation information

With Provision by those can be selected: Everything, Name and Category:

If Everything is selected then AnyConnect will try to collect information about all installed applications
If Name is selected then specific application can be selected for the policy. For example:

If Category is selected then AnyConnect collects information about all appliactions from specified category. For example:

In order to collect information about installed and applications that are running at Policy > Policy Elements > Conditions > Posture > Application Condition, Click Add to create new condition and fill required fields as shown:

Step 3. Create Posture Requirement

In Policy > Policy Elements > Results > Posture > Requirements create new requirement with created Application Condition:

Step 4. Create Posture Policy

To enable ISE and AnyConnect to collect information about applications a requirement with an Application Condition should be included in Posture Policy. Posture policy can be created at Policy > Posture. The requirement might be set as Audit if you would like to collect information for further usage.

Step 5 (Optional). Change Continuous Monitoring Interval

ISE allows you configure how often AnyConnect should send updates about applications to ISE. By default the interval is set to 5 minutes and can be changed at Administration > Settings > Posture > General Settings:

Step 6 (Optional). Create App Compliance

After data is collected from the Endpoint, App Compliance can be created at Context Visibility > Endpoints > [ENDPOINT]:

Select an application:
Click Policy Actions > Create App Compliance
Fill the fields in a pop-up window:
Click Save Policy, those items should be created:
- Posture Application Condition
- Posture Application Remediation Action
- Posture Requirement
- Posture Policy

Verify

Use this section in order to confirm that your configuration works properly.

LiveLogs

In RADIUS LiveLogs the flow looks like a usual posture flow: Authentication + Redirection to provisioning portal > Change of Authorization (CoA) > Match of compliant posture policy.

Endpoint

After Client Provisioning (if AnyConnect was not provisioned before) and Continuous Monitoring Interval configuration, process of data collection can be verified at Context Visibility > Endpoints. Click on MAC address of the endpoint, the endpoint's page should open. It contains information about applications installed on the endpoint itself:

Due to CSCve82743, you will need to access the endpoint twice and hit Refresh to render the table of applications.

Posture Policy Elements

Those elements should be created with Create App Compliance option:

Posture Application Condition
Posture Application Remediation Action
Posture Requirement
Posture Policy

Each of them can be verified from ISE GUI. Conditions are located at Policy > Policy Elements > Conditions > Posture > Application Condition:

Remediations are located at Policy > Policy Elements > Results > Posture > Remediation Actions > Application Remediations:

Requirements are located at Policy > Policy Elements > Results > Posture > Requirements:

Policies are located at Policy > Posture:

Reports

Each Posture report from each EndPoint is stored on ISE and can be checked from Operations > Reports. There are to variants of Posture reports:

Posture Assessment by Endpoint - it provides details about posture compliancy for a particular endpoint.
Posture Assessment by Condition - it provides details about posture policy conditions. It shows which conditions failed and which conditions passed. Only Mandatory and Optional conditions are shown.

Posture Assessment by Condition

Posture Assessment by Condition looks as shown. In this example one of mandatory conditions fails so the posture status goes to non-compliant:

Posture Assessment by Endpoint

Posture Assessment by Endpoint:

Details of each posture check can be checked by click on Details Report icon -

Troubleshoot

This section provides information you can use in order to troubleshoot your configuration.

From ISE

ise-psc.log contains all posture related information, including debugs. Posture debugs can be enabled at Administration > System > Logging > Debug Log Configuration. component name is posture:

Once an endpoint is connected to the network and AnyConnect reach out to the ISE, ISE checks if EP should be checked against configured posture checks and detects version of Compliance Module which installed on the EP. Based on collected information ISE generates posture query for the EP - NAC agent xml and encrypts it. Later, ISE sends this query to AnyConnect.

2017-01-04 19:19:13,686 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- About to query posture policy for user cisco with endpoint mac C0-4A-00-15-75-C8 
2017-01-04 19:19:13,687 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureManager -:cisco:::- agentCMVersion=4.2.468.0, agentType=AnyConnect Posture Agent, groupName=OESIS_V4_Agents -> found agent group with displayName=4.x or later
2017-01-04 19:19:13,687 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- User cisco belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any
2017-01-04 19:19:13,687 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- About to retrieve posture policy resources for os 7 Enterprise, agent group 4.x or later and identity groups [NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation, NAC Group:NAC:IdentityGroups:Any]
2017-01-04 19:19:13,687 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by agent group with FQN NAC Group:NAC:AgentGroupRoot:ALL:OESIS_V4_Agents
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- The evaluation result by agent group for resourceId NAC Group:NAC:Posture:PosturePolicies:Apps is Permit
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by OS group with FQN NAC Group:NAC:OsGroupRoot:ALL:WINDOWS_ALL:WINDOWS_7_ALL:WINDOWS_7_ENTERPRISE_ALL
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- stealth mode is 0
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- The evaluation result by os group for resourceId NAC Group:NAC:Posture:PosturePolicies:Apps is Permit
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by Stealth mode NSF group with FQN NAC Group:NAC:StealthModeStandard
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Procesing obligation with posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Found obligation id urn:cisco:cepm:3.3:xacml:response-qualifier for posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Found obligation id PostureReqs for posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps
2017-01-04 19:19:13,688 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Posture policy resource id Apps has following associated requirements []
2017-01-04 19:19:13,720 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- policy enforcemnt is 2
2017-01-04 19:19:13,720 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- simple condition: [Name=Apps_Collection, Description=null, Application State =installed,runnning, Provision By =Everything, monitory  Categories = []]
2017-01-04 19:19:13,720 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- check type is ApplicationVisibility
2017-01-04 19:19:13,800 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- NAC agent xml <?xml version="1.0" encoding="UTF-8"?><cleanmachines>
  <version>ISE: 2.2.0.423</version>
  <encryption>0</encryption>
  <package>
    <id>12</id>
    <name>Apps_collection</name>
    <description>Apps Check</description>
    <version/>
    <type>3</type>
    <optional>2</optional>
    <action>3</action>
    <check>
      <id>Apps_Collection</id>
      <category>12</category>
      <type>1202</type>
      <monitor>ALL</monitor>
      <evaluation>periodic</evaluation>
    </check>
    <criteria>(Apps_Collection)</criteria>
  </package>
</cleanmachines>

2017-01-04 19:19:13,800 INFO   [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil - getPosturePolicyHTML [<cleanmachines><version>ISE: 2.2.0.423</version><encryption>0</encryption><package><id>12</id><name>Apps_collection</name><description>Apps Check</description><version/><type>3</type><optional>2</optional><action>3</action><check><id>Apps_Collection</id><category>12</category><type>1202</type><monitor>ALL</monitor><evaluation>periodic</evaluation></check><criteria>(Apps_Collection)</criteria></package></cleanmachines>]
2017-01-04 19:19:13,800 INFO   [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil -getPosturePolicyHTML - do encrypt 
2017-01-04 19:19:13,800 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- Encrypting policy using AES key.
2017-01-04 19:19:13,800 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.CipherUtil -:cisco:::- Encrypting message using AES.
2017-01-04 19:19:13,800 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- IV Base 64: AeUQGbj6CP/jMB+cTIGIGQ==
2017-01-04 19:19:13,801 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil.getPosturePolicyHTML() returns <!--X-Perfigo-UserKey=--><!--X-Perfigo-Provider=Device Filter--><!--X-Perfigo-UserName=cisco--><!--error=1010--><!--X-Perfigo-DM-Error=1010--><!--user role=--><!--X-Perfigo-OrigRole=--><!--X-Perfigo-DM-Scan-Req=0--><!--X-ISE-IV=AeUQGbj6CP/jMB+cTIGIGQ==--><!--X-Perfigo-DM-Software-List=f5aGq8rU5wx7hFS9WnugNhy/6HaSxNtKesoqAjYkecEk56t+I/J93PtAYU0XLq451NXQhReuFktImYEPEnWwOs1bV5oOTuTsY3kEbcuR4p5Sp0cfz/j98YEubNtSKDCUGt5U8dhpOJqMYTV4UcaSP/D0FXYm10gFEjPxpPghyWcplzYwcpehIX+2vOYOSzPTEvM2kDdHTkof+/UYvBfGv8Y7YkK9P61upfSedIqdynyxUbeqknXkoCaWvUawJLVWiXAJs2atsCwJjXitwNHYzCuH/mBz/Y9AUvbLCB/cutCeyVCl7ij8wtXUAt2NpKqeEj0COOxnp5B35JTBfOSXHfVjL29E5JALaun6RR8yJlkd4apk7qflnjsu451CHY/SbKTMnqjV5bNwXfuCBf++X6X/mh0nwk+r2iWhJJFyqmNxBm2BvcJAJXOKOV7xHIhgmLj+etF4Sss/zwnFT4+WTzKI+BpbrVdnZjUP7+uvbQbIPtRFqJVI5StjZlIP4vLzFWKbWXI+itTX6hjqvNhiT2zwktvIboUZXaBV6yS5/+5cYMU3+EhWxIx/UVo0o7sX--><!--X-Perfigo-DM-Session-Time=240-->
2017-01-04 19:19:13,801 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- User cisco belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any
2017-01-04 19:19:13,801 DEBUG  [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- Sending response to endpoint C0-4A-00-15-75-C8 http response [[ <!--X-Perfigo-UserKey=--><!--X-Perfigo-Provider=Device Filter--><!--X-Perfigo-UserName=cisco--><!--error=1010--><!--X-Perfigo-DM-Error=1010--><!--user role=--><!--X-Perfigo-OrigRole=--><!--X-Perfigo-DM-Scan-Req=0--><!--X-ISE-IV=AeUQGbj6CP/jMB+cTIGIGQ==--><!--X-Perfigo-DM-Software-List=f5aGq8rU5wx7hFS9WnugNhy/6HaSxNtKesoqAjYkecEk56t+I/J93PtAYU0XLq451NXQhReuFktImYEPEnWwOs1bV5oOTuTsY3kEbcuR4p5Sp0cfz/j98YEubNtSKDCUGt5U8dhpOJqMYTV4UcaSP/D0FXYm10gFEjPxpPghyWcplzYwcpehIX+2vOYOSzPTEvM2kDdHTkof+/UYvBfGv8Y7YkK9P61upfSedIqdynyxUbeqknXkoCaWvUawJLVWiXAJs2atsCwJjXitwNHYzCuH/mBz/Y9AUvbLCB/cutCeyVCl7ij8wtXUAt2NpKqeEj0COOxnp5B35JTBfOSXHfVjL29E5JALaun6RR8yJlkd4apk7qflnjsu451CHY/SbKTMnqjV5bNwXfuCBf++X6X/mh0nwk+r2iWhJJFyqmNxBm2BvcJAJXOKOV7xHIhgmLj+etF4Sss/zwnFT4+WTzKI+BpbrVdnZjUP7+uvbQbIPtRFqJVI5StjZlIP4vLzFWKbWXI+itTX6hjqvNhiT2zwktvIboUZXaBV6yS5/+5cYMU3+EhWxIx/UVo0o7sX--><!--X-Perfigo-DM-Session-Time=240--> ]]
2017-01-04 19:19:13,959 DEBUG  [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- receiving request from client C0:4A:00:15:75:C8 10.62.148.162 bcu5ksw0
2017-01-04 19:19:13,966 DEBUG  [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found the ipAddress that matched the http request remote address 10.62.148.162 and corresponding client mac address C0-4A-00-15-75-C8
2017-01-04 19:19:13,966 DEBUG  [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- looking for Radius session with input values : sessionId: 0a3e946500000066586d3c42, MacAddr: C0-4A-00-15-75-C8, ipAddr: 10.62.148.162 
2017-01-04 19:19:13,966 DEBUG  [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- looking for session using session ID: 0a3e946500000066586d3c42, IP addrs: [10.62.148.162], mac Addrs [C0-4A-00-15-75-C8]
2017-01-04 19:19:13,966 DEBUG  [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- Found session using sessionId 0a3e946500000066586d3c42

The full report from AnyConnect. This report contains information about all found applications which match configured Application Condition.

2017-01-04 19:19:37,358 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- UDID is 766bb955e51e4ab063fd478c63acee81260ca592 for end point C0-4A-00-15-75-C8
2017-01-04 19:19:37,358 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- os version from user agent is 1.2.1.6.1.4
2017-01-04 19:19:37,358 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Received posture request [parameters: reqtype=, userip=10.62.148.162, clientmac=C0-4A-00-15-75-C8, os=, osVerison=1.2.1.6.1.4, architecture=, provider=, state=, userAgent=Mozilla/4.0 (compatible; WINDOWS; 1.2.1.6.1.4; AnyConnect Posture Agent v.4.4.00209), session_id=
2017-01-04 19:19:37,358 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found a session info for endpoint C0-4A-00-15-75-C8 cisco
2017-01-04 19:19:37,358 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Got userid cisco from cache for endpoint C0-4A-00-15-75-C8/
2017-01-04 19:19:37,358 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Report IV in Base64: JjneGgZcJbmjqMKQcy8kJg==
2017-01-04 19:19:37,359 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Using AES shared secret to decrypt report.
2017-01-04 19:19:37,359 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.util.CipherUtil -::::- Decrypting message using AES.
2017-01-04 19:19:37,359 DEBUG  [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Decrypted report [[ <report><version>1000</version><package><id>12</id><status>1</status><check><chk_id>Apps_Collection</chk_id><diff>0</diff><application><diff>0</diff><id></id><name>Adobe Flash Player 23 NPAPI</name><vendor>Adobe Systems Incorporated</vendor><version>23.0.0.207</version><category>Unclassified</category></application><application><diff>0</diff><id>104</id><name>Adobe Flash Player</name><vendor>Adobe Systems Inc.</vendor><version>23.0.0.207</version><path>C:\Windows\SysWOW64\Macromed\Flash\</path><category>Unclassified</category></application><application><diff>0</diff><id>873</id><name>BitLocker Drive Encryption</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>DiskEncryption</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Diagnostics and Reporting Tool</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\DART\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect ISE Compliance Module</name><vendor>Cisco Systems, Inc</vendor><version>4.2.468.0</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\opswat\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect ISE Posture Module</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path><category>Unclassified</category><process><diff>0</diff><pid>704</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path><hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash></process><process><diff>0</diff><pid>1296</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path><hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash></process><process><diff>0</diff><pid>3076</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path><hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash></process><process><diff>0</diff><pid>3384</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path><hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash></process><process><diff>0</diff><pid>15924</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path><hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash></process></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Profile Editor</name><vendor>Cisco Systems, Inc.</vendor><version>4.1.08005</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Profile Editor\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Secure Mobility Client </name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Secure Mobility Client</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path><category>Unclassified</category><process><diff>0</diff><pid>704</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path><hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash></process><process><diff>0</diff><pid>1296</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path><hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash></process><process><diff>0</diff><pid>3076</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path><hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash></process><process><diff>0</diff><pid>3384</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path><hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash></process><process><diff>0</diff><pid>15924</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path><hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash></process></application><application><diff>0</diff><id></id><name>Cisco NAC Agent </name><vendor>Cisco Systems, Inc.</vendor><version>4.9.5.10</version><path>C:\Program Files (x86)\Cisco\Cisco NAC Agent\</path><category>Unclassified</category><process><diff>0</diff><pid>1444</pid><path>c:\program files (x86)\cisco\cisco nac agent\nacagent.exe</path><hash>502EF2A864254A2DF555E029BE2C39E94B111E8B01534D7161826650DE4CEB4D</hash></process><process><diff>0</diff><pid>2320</pid><path>c:\program files (x86)\cisco\cisco nac agent\nacagentui.exe</path><hash>DC617419F082BEAF26521E48CB410282631F93F1359E604A4D3D181A04FEE1FB</hash></process></application><application><diff>0</diff><id>293</id><name>DAEMON Tools Lite</name><vendor>Disc Soft Ltd</vendor><version>4.49.1.0356</version><path>C:\Program Files (x86)\DAEMON Tools Lite\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Digital Operatives PAINT Beta</name><vendor></vendor><version>0.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>FileZilla Server</name><vendor>FileZilla Project</vendor><version>beta 0.9.44</version><path>C:\Program Files (x86)\FileZilla Server\</path><category>Unclassified</category><process><diff>0</diff><pid>1408</pid><path>c:\program files (x86)\filezilla server\filezilla server.exe</path><hash>E8DB1409DB694A90C759F418346AE5D71014AE3513A8B865B50923AD0DFEE395</hash></process><process><diff>0</diff><pid>2348</pid><path>c:\program files (x86)\filezilla server\filezilla server interface.exe</path><hash>F57B0A7F4A9EBAACC1A67323EBB93D96FA910524FAE842953551DBA103EF71C5</hash></process></application><application><diff>0</diff><id>180</id><name>FileZilla</name><vendor>FileZilla Project</vendor><version>3.8.1.0</version><path>C:\Program Files (x86)\FileZilla FTP Client\</path><category>FileShare</category></application><application><diff>0</diff><id>39</id><name>Google Chrome</name><vendor>Google Inc.</vendor><version>55.0.2883.87</version><path>C:\Program Files (x86)\Google\Chrome\Application\</path><category>AntiPhishing,Browser</category></application><application><diff>0</diff><id></id><name>Google Update Helper</name><vendor>Google Inc.</vendor><version>1.3.24.15</version><category>Unclassified</category></application><application><diff>0</diff><id>100</id><name>Internet Explorer</name><vendor>Microsoft Corporation</vendor><version>11.0.9600.18524</version><path>C:\Program Files\Internet Explorer\</path><category>AntiPhishing,Browser</category></application><application><diff>0</diff><id></id><name>Java 7 Update 79</name><vendor>Oracle</vendor><version>7.0.790</version><path>C:\Program Files (x86)\Java\jre7\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Java 8 Update 91</name><vendor>Oracle Corporation</vendor><version>8.0.910.15</version><path>C:\Program Files (x86)\Java\jre1.8.0_91\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Java Auto Updater</name><vendor>Oracle Corporation</vendor><version>2.8.91.15</version><category>Unclassified</category></application><application><diff>0</diff><id>111</id><name>Java</name><vendor>Oracle Corporation</vendor><version>7.0.790.15</version><path>C:\Program Files (x86)\Java\jre7\bin\</path><category>Unclassified</category></application><application><diff>0</diff><id>111</id><name>Java</name><vendor>Oracle Corporation</vendor><version>8.0.910.15</version><path>C:\Program Files (x86)\Java\jre1.8.0_91\bin\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft .NET Framework 4.6.1</name><vendor>Microsoft Corporation</vendor><version>4.6.01055</version><path>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.6.01055\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Network Monitor 3.4</name><vendor>Microsoft Corporation</vendor><version>3.4.2350.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Network Monitor: NetworkMonitor Parsers 3.4</name><vendor>Microsoft Corporation</vendor><version>3.4.2350.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148</name><vendor>Microsoft Corporation</vendor><version>9.0.30729.4148</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148</name><vendor>Microsoft Corporation</vendor><version>9.0.30729.4148</version><category>Unclassified</category></application><application><diff>0</diff><id>44</id><name>Mozilla Firefox</name><vendor>Mozilla Corporation</vendor><version>47.0.2</version><path>C:\Program Files (x86)\Mozilla Firefox\</path><category>AntiPhishing,Browser</category><process><diff>0</diff><pid>8292</pid><path>c:\program files (x86)\mozilla firefox\firefox.exe</path><hash>47F80E4FC4C43FAF468D94F5D51AAC78A125CC720FCBEA0B88B5F29D06719CE9</hash></process></application><application><diff>0</diff><id></id><name>Mozilla Maintenance Service</name><vendor>Mozilla</vendor><version>47.0.2.6148</version><category>Unclassified</category></application><application><diff>0</diff><id>298</id><name>Notepad++</name><vendor>Notepad++ Team</vendor><version>6.63</version><path>C:\Program Files (x86)\Notepad++\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3122661)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3127233)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3136000v2)</name><vendor>Microsoft Corporation</vendor><version>2</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3142037)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3143693)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3164025)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>TP-LINK TL-WDN3200 Driver</name><vendor>TP-LINK</vendor><version>1.1.0</version><path>C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility and Driver\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Tftpd32 Standalone Edition (remove only)</name><vendor></vendor><version>0.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>VMware Tools</name><vendor>VMware, Inc.</vendor><version>9.4.15.2827462</version><path>C:\Program Files\VMware\VMware Tools\</path><category>Unclassified</category><process><diff>0</diff><pid>952</pid><path>c:\program files\vmware\vmware tools\vmtoolsd.exe</path><hash>5C642EF7F4EF65A0445B2C2CD227F9431835712EE7F1BD4D01D1F7472199DE47</hash></process><process><diff>0</diff><pid>1516</pid><path>c:\program files\vmware\vmware tools\vmtoolsd.exe</path><hash>5C642EF7F4EF65A0445B2C2CD227F9431835712EE7F1BD4D01D1F7472199DE47</hash></process></application><application><diff>0</diff><id></id><name>WinPcap 4.1.3</name><vendor>Riverbed Technology, Inc.</vendor><version>4.1.0.2980</version><category>Unclassified</category></application><application><diff>0</diff><id>300</id><name>WinPcap</name><vendor>Riverbed Technology, Inc.</vendor><version>4.1.0.2980</version><path>C:\Program Files (x86)\WinPcap\</path><category>Unclassified</category></application><application><diff>0</diff><id>923</id><name>Windows Backup and Restore</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>BackupClient</category></application><application><diff>0</diff><id>362</id><name>Windows Defender</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Program Files\Windows Defender\</path><category>AntiMalware</category></application><application><diff>0</diff><id>283</id><name>Windows Firewall</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>FireWall</category></application><application><diff>0</diff><id>1612</id><name>Windows Media Player</name><vendor>Microsoft Corporation</vendor><version>12.0.7601.23517</version><path>C:\Program Files\Windows Media Player\</path><category>Unclassified</category><process><diff>0</diff><pid>1596</pid><path>c:\program files\windows media player\wmpnetwk.exe</path><hash>306467D280E99D0616E839278A4DB5BED684F002AE284C3678CABB5251459CB3</hash></process></application><application><diff>0</diff><id>1587</id><name>Windows Security Health Agent</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>HealthAgent</category></application><application><diff>0</diff><id>1090</id><name>Windows Update Agent</name><vendor>Microsoft Corporation</vendor><version>7.6.7601.19161</version><path>C:\Windows\System32\</path><category>PatchManagement</category></application><application><diff>0</diff><id>1106</id><name>Windows VPN Client</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>VPNClient</category></application><application><diff>0</diff><id>207</id><name>Wireshark</name><vendor>The Wireshark developer community</vendor><version>1.10.7</version><path>C:\Program Files (x86)\Wireshark\</path><category>Unclassified</category></application></check></package></report> ]]
...

All reports are XML strings. Sample formatted report:

<report>
	<version>1000</version>
	<package>
		<id>12</id>
		<status>1</status>
		<check>
			<chk_id>Apps_Collection</chk_id>
			<diff>0</diff>
			<application>
				<diff>0</diff>
				<id>104</id>
				<name>Adobe Flash Player</name>
				<vendor>Adobe Systems Inc.</vendor>
				<version>23.0.0.207</version>
				<path>C:\Windows\SysWOW64\Macromed\Flash\</path>
				<category>Unclassified</category>
			</application>
...
			<application>
				<diff>0</diff>
				<id></id>
				<name>Cisco AnyConnect ISE Posture Module</name>
				<vendor>Cisco Systems, Inc.</vendor>
				<version>4.4.00209</version>
				<path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path>
				<category>Unclassified</category>
				<process>
					<diff>0</diff>
					<pid>704</pid>
					<path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path>
					<hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash>
				</process>
				<process>
					<diff>0</diff>
					<pid>1296</pid>
					<path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path>
					<hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash>
				</process>
				<process>
					<diff>0</diff>
					<pid>3076</pid>
					<path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path>
					<hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash>
				</process>
				<process>
					<diff>0</diff>
					<pid>3384</pid>
					<path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path>
					<hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash>
				</process>
				<process>
					<diff>0</diff>
					<pid>15924</pid>
					<path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path>
					<hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash>
				</process>
			</application>
...
		</check>
	</package>
</report>

AnyConnect sends full reports only on first connection. Further it sends only changes. For example, Notepad++ was started after some time:

2017-01-04 19:24:37,929 DEBUG  [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Received posture request [parameters: reqtype=, userip=10.62.148.162, clientmac=C0-4A-00-15-75-C8, os=, osVerison=1.2.1.6.1.4, architecture=, provider=, state=, userAgent=Mozilla/4.0 (compatible; WINDOWS; 1.2.1.6.1.4; AnyConnect Posture Agent v.4.4.00209), session_id=
2017-01-04 19:24:37,929 DEBUG  [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found a session info for endpoint C0-4A-00-15-75-C8 cisco
2017-01-04 19:24:37,929 DEBUG  [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Got userid cisco from cache for endpoint C0-4A-00-15-75-C8/
2017-01-04 19:24:37,929 DEBUG  [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Report IV in Base64: JjneGgZcJbmjqMKQcy8kJg==
2017-01-04 19:24:37,929 DEBUG  [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Using AES shared secret to decrypt report.
2017-01-04 19:24:37,929 DEBUG  [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.util.CipherUtil -::::- Decrypting message using AES.
2017-01-04 19:24:37,930 DEBUG  [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Decrypted report [[ <report><version>1000</version><package><id>12</id><status>1</status><check><chk_id>Apps_Collection</chk_id><diff>1</diff><application><diff>2</diff><id>298</id><name>Notepad++</name><vendor>Notepad++ Team</vendor><version>6.63</version><path>C:\Program Files (x86)\Notepad++\</path><category>Unclassified</category><process><diff>0</diff><pid>16460</pid><path>c:\program files (x86)\notepad++\notepad++.exe</path><hash>43E9F528CD2405E6DD117857D440A634769C6E11C4D986605354C2605B6E7D84</hash></process></application></check></package></report> ]]

Formatted:

<report>
	<version>1000</version>
	<package>
		<id>12</id>
		<status>1</status>
		<check>
			<chk_id>Apps_Collection</chk_id>
			<diff>1</diff>
			<application>
				<diff>2</diff>
				<id>298</id>
				<name>Notepad++</name>
				<vendor>Notepad++ Team</vendor>
				<version>6.63</version>
				<path>C:\Program Files (x86)\Notepad++\</path>
				<category>Unclassified</category>
				<process>
					<diff>0</diff>
					<pid>16460</pid>
					<path>c:\program files (x86)\notepad++\notepad++.exe</path>
					<hash>43E9F528CD2405E6DD117857D440A634769C6E11C4D986605354C2605B6E7D84</hash>
				</process>
			</application>
		</check>
	</package>
</report>

From AnyConnect

File AnyConnect_ISEPosture.txt contains all related logs and debugs. This file can be found in DART Bundle collected on an endpoint. Here is an example of a periodic report, it is encrypted with AES256:

******************************************

Date        : 01/04/2017
Time        : 19:34:38
Type        : Unknown
Source      : acise

Description : Function: Authenticator::bldMonitorReport
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 724
Level: info

Monitor Report: &user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1IvCqrVOplj17TAcVXEht8NkDg0OT9jM%2fTNH%2fMKllc0o6Ha5juJo4YtWDWY%2bnOancw%3d%3d. 

******************************************

Date        : 01/04/2017
Time        : 19:34:38
Type        : Unknown
Source      : acise

Description : Function: Authenticator::buildAndSendHttpMsg
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 196
Level: debug

MSG_SN_HTTP_REQUEST, {{url="https://ise22-pri.example.com:8443/auth/perfigo_validate.jsp"}, {server="ise22-pri.example.com"}, {method="post"}, {object_path=""}, {reuse_existing=1}, {close_when_done=0}, {pkt="&user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1IvCqrVOplj17TAcVXEht8NkDg0OT9jM%2fTNH%2fMKllc0o6Ha5juJo4YtWDWY%2bnOancw%3d%3d"}, {path=""}, {type=1}}. 

******************************************

Date        : 01/04/2017
Time        : 19:34:39
Type        : Unknown
Source      : acise

Description : Function: HttpHandler::createOutgoingHTTPSMessage
Thread Id: 0xD3C
File: HttpHandler.cpp
Line: 295
Level: debug

MSG_NS_HTTP_RESPONSE, {{success=1}, {pkt="<!--error=0--><!--X-Perfigo-DM-Error=0--><!--X-Perfigo-Monitoring-Interval=5-->"}, {type=1}}.

Common issues

AnyConnect cannot reach ISE

In this case AnyConnect_ISEPosture.txt contains errors:

******************************************

Date        : 01/04/2017
Time        : 20:04:40
Type        : Unknown
Source      : acise

Description : Function: Authenticator::buildAndSendHttpMsg
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 196
Level: debug

MSG_SN_HTTP_REQUEST, {{url="https://ise22-pri.example.com:8443/auth/perfigo_validate.jsp"}, {server="ise22-pri.example.com"}, {method="post"}, {object_path=""}, {reuse_existing=1}, {close_when_done=0}, {pkt="&user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1Pdu7AztTn%2f3VYph9WNF1jGljXSuTFmr38e%2bvDXQnx7avYHs9meVItYqA6MecAJK3WdkBNSrK1bYjmIvzkAPqR2LuoflnA9IcNOTZQ9iN%2fknOjlLqsiV5eV6jlMSUeOakKsTwy1gbPsFz99eKdtaCMv1F%2fsAmvLApjpke0IMKorXXkvpJURtAtOMK75ltXdykC85ihgHcI10JW7mlpvIppk5MbCZjihQbXldr5%2fQVdpB8eRqMHF1iCK1gx96lwwdzBSfr%2bgrcF4072fYYNOa9cYnTFShgU%2bxrnBDcJ1GUoYE9K5nTfGQ01p4NrcbLjpM79e14v14YgfQhmSfktwxfA8pY7A6jmL3BIp3O9gmQVnoTqaaccqkW76uT%2bPkjVOyrOgdG0CYwUwUMVqpctGKorxx1C3IwXhBWUmvRY9p2LRdePRqnCN8hpiesyk%2bzTnyX0OaNdHD6%2bGEMGo9QjQvwrL9dcvrUxxHtlQcJPekXajXPfn98FpC8z%2b966tcz4DfMN6giSlEfK6y5%2bMpk0oAL%2fV4XMg296PDocGaeTK1OUR7Qkl%2b7S2fv%2fCfZdiQaTndZ6zHWuimq5JBRElmuKI9hWRN2cPERcDn64ISZZSiz9yPoJPlPPpFsfggkc2PdS0OEEtMiM%2bBjNKcFx2Tcsq76eYfDtvDq9tGzjST8opInlIiXdAzdbeWsjCAerCvS73xg2vd2DHfpFlrd5lVa3qwo3Vov3nFiAz4l3IrI1fOHjAE7rCZTy2dWU455icOjmO%2bCVAS3SzWCea4fZu3fAhmIhAVQKE1cFZ4CyyBv8934OVw62Bxu5ij0wbHOStA8TSbxJXyuGBw8cqTPfuUtqPLx6nWtcRZ6p13MuQTq%2bKZLZ7hwY2Urf1o1Gi9OPGyo5zuJZAuQInU%2bkJKU6ycXHZo17Uti3DITCy0%2fG%2bQ2gixzBIpmJctekKJO243rZiU1wbOUPWLzGum8ydRu3im2LiDisXquAu7ipY5P0D475AZN3Cd6nlIPP5MOra493QhX4Il39q%2birT1%2f5F7tI%2fKLv20fWFC%2fjKbfu%2bFe4QIbdtiSCvLkyZ%2bWDwBMWSXHGE11CoErbj4LJP3h4oqLto17riGCYMb%2bRHZXNJA2bwjcfgY4w2FE4hrL0cC6D3YgZxHHpUeT4gMXoXj0EJwODxQwElc9yfoe%2bDgJ4Fy6%2fXc0ymDFYU7oOouAc0nwPKZwhZn4Q3mMZIG5aeOFcx9IM6M47IcMMbo0r78aUk8M94h5f4sK6JxHz75B6JyTx3H%2bxFDJ3j5UtUYj1oir4CLQJgR8ABhMDGxqhAN4c4wA4y790bh2F5PxkVXMGYb4ghFNt3jIHGXRMENPTYkelnD0fa1mMmhJUXE%2fVAshJ8aZwcGCU%2fNhSkCATRXb5UDAmeaSkwe3m4bcRtfBbNZ1l5CNQVH8ZPZsKlGCNpD6dOYkSxa%2ffErYqImEzm9itwSzUujQXI%2f8%2f%2fKewc9jeBujwHqnjuIYg5sJbjk%2bqc%2fwy5hKHTbxFacnFJlgvJhHt3mht8oRC9EbbsULoAK1fvLe4%2fE%2bqFjOe02bw4sQuu1ssMKxLsNQMCTIZFzhl0K6BZdfo1RonKG0MEG1K%2ftSDNC4eyQw9ewYhgpozDVHW1yprpVY9UgcTvFVSh0Vy%2bWde4b0dtmPdhbQhvvsQOSgnxIX6a8GN4AwXEoE7CoP6%2fFZiTAJTuxUKMjC1m8iAsrAurJugnEgaKKugSNkl9y7bgSiYB6zkthDclEyBFWc1rAEcfH6oMJs59aJodXnPSAA9FuyqLCWB%2f3WFZ03efhTviz2101G8%2fsWMxR0w%2fR56oNH2wzUwkmh9oczFaYLpJPzg6k47oh1zmDJraqyvWgzzfPIipa7EKK8YvsuO4BCFgMrDZtYZnCO6B9CFoKDCNJE9Wxl%2bhTdzFCA4GpeLE4nT7y1j113iTV%2faWyImNLaRMU2ZiwuKy%2bd2OH55LqnLBCxrUUIMH7Ku4Mhd%2fYvw1NVpcZZ0L%2bWOkMoephk2XXE4OQAY7Rk%2f%2fRnCbbHlFOVQmEVOoxNneBElleajK%2fxX6C0BZBaebAVYluwdGkkktvgQ5gUvzMiyqbsvzyUMzq%2fhqKY7vVMWUeyCsBnybuGPSILJIkMgdgjiz%2baUZsOyZsUE%2b7PPyiqphqXNRfQ6tj8wTzq7a2Z5XgCYI10Piqj1mg6hY1TiRYuPanyBqh61LFKxblkpQJX2339pqB4RBOzF4%2f3CsvfjU302NSU9fypX5dBYubAZt80DOBe84FSnQIX3pfX2%2fW9LqclyWbxC2QSOfHoe6TgkCiOall%2fqUHWqeOogbgLO5s5ffBoNmUCxhJW%2fH1EqKcsFzA%2ba%2f2Q0%2bs2m99Rqlxdd55bg67LXVPGfKh2dbVHjghXjO90nLEtVwCfs8oMUIg%2bmnip%2fdA7wDz4Nsma2W0ugEhOjpfFbL2TxHLhE0r%2bwy3t%2bosvtaXNJZg84LJKpt3J%2bmc0pnIBH5S5H7zrNDKUnIYXY8BD5n1clZi4wwkRIp62avJw7lN22zNHsjp7NUjTYw9X%2f1Iti1TKxjPZuitU%2bITeCRRHzeoaeGbzE1E%2bGSSqemw7F1wx4w9JXHDajH%2bY4iX7z2Y4OrY1JQQleeS9KWzw5HdiCpuHmhMtLMSpz%2fGagw7KeaLEe9FxwrOYILS%2fXuBStZ1XOpbQHIlH0ZdQbv2I%2bA%2f3j3GvalSul%2f0YVWlPPPIC2OgkSSbd4HyXXh9TEB8dhDmfucy5VEZ5MsuOTgytkALNSK0t9cyvsAcWTQf0uVAMnyBeaMPJAvdE9fXUiH628eMD9PHvt3cL0GYdRR9WBUcszIFtJNIA5AXj7abdbc6VZ8DqX4YfJ1xgTqg2qKSJqXvtbi5BJU49BGaxu01Ta6eBo2ABLtgBxKzb8DYNYqyqRB%2bYkgr5YdU6z6va15jQJYGUJYVwZ8xDsKvYHz1fUFAHldzxkq44myNAjD1H0DoYhQaXUl20UXkgO9w5kBqTfmKj9DOJhs5Q88ilebAbHHxm3GTZSJpP51jQjsPSUi3doX3Mz8E7W5pYptxtW1XPwcSHhkxuhWjbVKKQRTgM5uSXCPQ0PDAqcc6NybV2t1BK3GhQSPzsQ5k3wkldK7CYuUWMpKTMNLZDVF8i25DoGpA0K5m5s3VMAukLA9Gob5ysU%2fsu2TVBrJZDOsa3L%2bNoF2b01f8BC32e. 

******************************************

Date        : 01/04/2017
Time        : 20:04:41
Type        : Unknown
Source      : acise

Description : Function: hs_transport_winhttp_post
Thread Id: 0xD3C
File: hs_transport_winhttp.c
Line: 5776
Level: debug

unable to send request: 12029. 

******************************************

Date        : 01/04/2017
Time        : 20:04:41
Type        : Unknown
Source      : acise

Description : Function: HttpHandler::createOutgoingHTTPSMessage
Thread Id: 0xD3C
File: HttpHandler.cpp
Line: 295
Level: debug

MSG_NS_HTTP_RESPONSE, {{success=0}, {pkt=""}, {type=1}}. 

******************************************

Date        : 01/04/2017
Time        : 20:04:41
Type        : Error
Source      : acise

Description : Function: Authenticator::parsePostureData
Thread Id: 0xD3C
File: Authenticator.cpp
Line: 257
Level: error

Failed to communicate with CAS.. 

******************************************

Date        : 01/04/2017
Time        : 20:04:41
Type        : Error
Source      : acise

Description : Function: SMNavPosture::SMP_handleMonitorResp
Thread Id: 0xD3C
File: SMNavPosture.cpp
Line: 495
Level: error

Failed to parse monitor response. 

*****************************************

ISE throws "null" error when creating App Compliance from EP view

The most common reason of having "null" message during creation of App Compliance from EP view is absence of required OPSWAT charts. Posture Update to the most recent version should fix this issue.

Revision History

Revision	Publish Date	Comments
1.0	31-Mar-2017	Initial Release

Contributed by Cisco Engineers

Vitaly Kumov
Cisco TAC Engineer

Configure 2.2 Client Provisioning and Application

Available Languages

Bias-Free Language

Contents

Introduction

Prerequisites

Requirements

Components Used

Configure

Configurations

Section 1. Configure Client Provisioning

Step 1. Upload AnyConnect Package

Step 2. Download AnyConnect Compliance Module

Step 3. Create Posture profile

Step 4. Create AnyConnect Configuration

Step 5. Configure Client Provisioning Policies

Step 6. Create Authorization Profile for CP

Step 7. Configure Authorization Policies

Section 2. Configure Posture

Step 1. Update Posture

Step 2. Create Application Condition

Step 3. Create Posture Requirement

Step 4. Create Posture Policy

Step 5 (Optional). Change Continuous Monitoring Interval

Step 6 (Optional). Create App Compliance

Verify

LiveLogs

Endpoint

Posture Policy Elements

Reports

Posture Assessment by Condition

Posture Assessment by Endpoint

Troubleshoot

From ISE

From AnyConnect

Common issues

AnyConnect cannot reach ISE

ISE throws "null" error when creating App Compliance from EP view

Revision History

Contributed by Cisco Engineers

Was this Document Helpful?

Contact Cisco

This Document Applies to These Products