Understand Posture Lease in ISE

Available Languages

Download Options

  • PDF     (632.5 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (687.7 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (580.2 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:August 19, 2026
Document ID:222876

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes the configuration of posture lease in Cisco ISE.

Prerequisites

Requirements

  • Knowledge of Posture flow in Cisco ISE
  • Knowledge of AAA Policies in Cisco ISE

Components Used

The information in this document is based on these software and hardware versions:

  • Cat9300 Switch Version 17.9.5
  • Identity Service Engine (ISE) v3.2
  • PC Windows 10 Enterprise with ISE Posture Module 5.1.6

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Posture lease is a feature in Cisco ISE that stores the last known compliance status up to 365 days in DB and does not reach out to the endpoint to check for compliance. But when the posture lease expires, Cisco ISE does not automatically trigger a reauthentication or a posture reassessment for the endpoint. The endpoint stays in the same compliance state since the same session is being used. When the endpoint reauthenticates, the posture is run and the posture lease time is reset.

Posture lease is an endpoint attribute that stores in the Oracle DB, and stores the time in EPOCH time. The same can be validated from context visibility and Oracle DB.

Posture Expiry

Along with the posture lease, there is one more feature in ISE that caches the last known compliance status for the configurable amount of time (max 200 days / 4800 hours / 288000 minutes) configured in Last Known Posture Compliant State. This feature allows Cisco ISE to cache the last compliance status, and if an endpoint becomes non-compliant within the Last Known Posture Compliant State, ISE marks the endpoint as compliant until the grace period configured in posture policy.

Last Known Posture Compliant State value stores in the Oracle DB., it also stores in EPOCH time.

Configuration

To configure the posture lease in Cisco ISE:

1. Navigate to Work Centers > Posture > Settings > Posture Lease. Check the Perform posture assessment every __ Days and configure the number of Day(s) (1-365 Days). In this example, it is set to 1 Days.

2. Checkmark the Cache Last Known Posture Compliant Status and configure the Last Known Posture Compliant State time (max 200 days / 4800 hours / 288000 minutes). In this example, it is configured for 2 Days.

Posture Lease Configuration

3. For simplicity, only one posture policy (Windows FW check) has been enabled with a Grace period of 2 Minutes.

Posture Policy - Grace Period Settings

Verify

The Endpoint connects for the first time and is compliant.

Verify Endpoint Connects and is Compliant

Compliant Status

ISE-PSC.log (Posture in DEBUG)

In the ise-psc.log, you can see there is no expiry time in the DB as the EP is connecting for the first time:

2024-11-30 22:55:08,485 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-8][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019::::- posture expriy time retrieved from DB is "" for B4-96-91-26-EB-A1
2024-11-30 22:55:08,485 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-8][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019::::- PostureExpiry value for B4-96-91-26-EB-A1 is not a number :

The EP processes through the posture check and becomes compliant. Once the EP becomes compliant, ISE updates the DB with the expiry time as 1 Day (1733073953816):

2024-11-30 22:55:55,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019:alice:::- posture_bypass_test is null fast reconnect expiry time is1733073953816 2024-12-01T22:55:54.306+0530
2024-11-30 22:55:55,307 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019:alice:::- updating fast reconnect for end point B4:96:91:26:EB:A1 with 1 days of expiry time1733073953816 <------Updating posture lease in DB (EDF_POSTUREEXPIRY)
2024-11-30 22:55:55,307 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- updated posutre lease for session 08C9C50A000000177E20CE15

Also, ISE updates the DB with the grace period expiry time 1733160354306 (2 Days):

2024-11-30 22:55:55,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000147BE04019:alice:::- Starting new thread for updateGracePeriodTime
2024-11-30 22:55:55,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000147BE04019:alice:::- remove user from expiry list
2024-11-30 22:55:54,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000147BE04019:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], <---- grace period expiry time 1733160354306 <----------- Updating last known compliance status in DB (LAST_COMP_EXPIRY)

After reconnecting the EP, the session directly become complaint. As the posture lease is enabled, ISE retrieves the posture expiry time from the DB and marks the session as compliant:

Session Becomes Compliant

2024-11-30 23:04:17,673 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-11-30 23:04:17,673 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-11-30 23:04:17,677 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Querying posture expiry time by MAC B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture expriy time retrieved from DB is "1733073953816" for B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture lease expiry time 1733073953816 2024-12-01T22:55:53.816+0530 for B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- retrieved fast reconnect expiry time 1733073953816 2024-12-01T22:55:53.816+0530 for B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- B4-96-91-26-EB-A1 is within fast reconnect expiry
2024-11-30 23:04:17,680 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PosturePolicyUtil -:::::- User null belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any
2024-11-30 23:04:17,680 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Compliant

Scenario 1: Disable Posture Lease

1. Disable the posture lease and enable Cache Last Known Posture Compliant Status with Last Known Posture Compliant State of 2 Days. This scenario is also valid if the posture lease expires and EP connects afterwards.

Posture Lease Status

2. After EP authenticates, as posture lease is not enabled, ISE performs the posture check:

2024-12-01 18:39:50,901 DEBUG [PolicyEngineEvaluationThread-3][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-01 18:39:50,901 DEBUG [PolicyEngineEvaluationThread-3][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is not enabled. Posture status retrieved from LSD for B4-96-91-26-EB-A1 is Unknown
2024-12-01 18:39:50,901 DEBUG [PolicyEngineEvaluationThread-3][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Unknown

3. After the EP becomes compliant, ISE updates the DB within the grace period expiry time 1733231423117 (2 Days.)

2024-12-01 18:40:23,116 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000227EB700E6:alice:::- Starting new thread for updateGracePeriodTime
2024-12-01 18:40:23,117 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000227EB700E6:alice:::- remove user from expiry list
2024-12-01 18:40:23,117 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000227EB700E6:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1733231423117 <--------------Updating last known compliance status in DB (LAST_COMP_EXPIRY)
2024-12-01 18:40:23,117 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000227EB700E6:alice:::- Starting new thread for updateLastCompExpiryTime [B4:96:91:26:EB:A1], grace period expiry time 1733057867397

Status Compliant or Pending

Now, the EP becomes non-complaint. As in the posture policy, only windows FW is checked.

4. Disable the Windows FW and re-connect the EP. The EP becomes non-complaint, however, a 2 minute grace period is configured in the posture policy. Due to this, the AC posture module is showing the status as In grace period.

EP Becomes Non-Complaint

5. In the RADIUS live log, you can see the EP is marked as complaint, even though the posture check failed. After the grace period expired, the session became Non-Compliant.

EP Marked as Compliant

6. In the ise-psc.log, you can see when the EP connects, as the lease is not enabled, it checks the LSD to retrieve the posture status:

2024-11-30 23:26:16,482 DEBUG [PolicyEngineEvaluationThread-16][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-11-30 23:26:16,482 DEBUG [PolicyEngineEvaluationThread-16][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is not enabled. Posture status retrieved from LSD for B4-96-91-26-EB-A1 is Unknown
2024-11-30 23:26:16,483 DEBUG [PolicyEngineEvaluationThread-16][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Unknown

7. The posture check happens and it fails for the EP. After that, ISE checks the DB to retrieve the lastCompliantExpiry value, which is 1733160354306 (2 Days.)

2024-11-30 23:27:19,123 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- Last compliant expiry period for device with mac: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 has not expired lastCompliantExpiry: 1733160354306.

8. As the lastCompliantExpiry is still valid, it further checks the grace period configured on the posture policy which is configured as 2 mins.

2024-11-30 23:27:19,123 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- handleGracePeriod - calculateGracePeriod: B4-96-91-26-EB-A1.

2024-11-30 23:27:19,544 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- calculateGracePeriod - matched policy: Default_Firewall_Policy_Win with grace period: 2 for mac: B4-96-91-26-EB-A1
2024-11-30 23:27:19,544 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- calculateGracePeriod - grace period is: 2 for mac: B4-96-91-26-EB-A1

2024-11-30 23:27:19,546 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000147BE04019:alice:::- Added user with mac B4-96-91-26-EB-A1 udid 6d8a638f9acadd2851a6cd7eae947060a898ebc1 grace period list with an expiration time of 2024/11/30 23:29:19 and startTime of 2024/11/30 23:27:19 <---------------- Updating the Grace period in DB (LAST_GRACE_EXPIRY)
2024-11-30 23:27:19,546 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- handleGracePeriod - device with mac: B4-96-91-26-EB-A1 - has grace period: 2 mins.
2024-11-30 23:27:19,546 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- Device with session id: 08C9C50A0000001A7E3D5087, client mac: B4-96-91-26-EB-A1 - has grace period: 2. Marking posture status as compliant

9. After the grace period is over, the AC module sends the failed report to ISE. ISE checks the grace period in the DB and finds it has expired. Then, it marks the session as non-complaint and removes the LastCompExpiryTime and GracePeriodTime from DB:

2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- value from cache 1732989439545 and db 1732989439545
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- getGracePeriodAndUpdate - StartTime 1732989439545
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- Calculated the GracePeriod exp in min 0
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000177E20CE15:alice:::- GracePeriod value is 0 and removeUser
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000177E20CE15:alice:::- Starting new thread for updateGracePeriodTime
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- remove user from expiry list
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000177E20CE15:alice:::- Starting new thread for updateLastCompExpiryTime
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000177E20CE15:alice:::- Starting new thread for updateGracePeriodTime

10. If the EP reconnects again and becomes non-complaint, ISE does not honor the grace period of posture policy. As the last compliant period has already expired and the session is directly updated as Non-Complaint.

2024-12-01 00:49:40,004 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000177E20CE15:alice:::- handleGracePeriod - Last compliant period expired for device with mac: B4-96-91-26-EB-A1.

Scenario 2: Disable Posture Lease Along with Cache Last Known Posture Compliant Status

Disable Posture Lease

1. In this case, by default, ISE updates lastCompliantexpiry time to 365 days in the DB.

2. As the posture lease is not enabled, posture check occurs and the EP becomes complaint after ISE updates the lastCompliant expiry time to 365 Days in the DB.

2024-12-01 00:58:17,191 DEBUG [PolicyEngineEvaluationThread-12][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-01 00:58:17,191 DEBUG [PolicyEngineEvaluationThread-12][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is not enabled. Posture status retrieved from LSD for B4-96-91-26-EB-A1 is Unknown
2024-12-01 00:58:17,191 DEBUG [PolicyEngineEvaluationThread-12][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Unknown

2024-12-01 00:58:56,722 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- handleGracePeriod - Device is compliant. Removing device with mac: B4-96-91-26-EB-A1 from grace period map

2024-12-01 00:58:56,723 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000147BE04019:alice:::- Last cache time period is not set, setting lastCompliant expiry time to 365 days
2024-12-01 00:58:56,723 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000147BE04019:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1764530936723 <------------Updating last known compliance status in DB (LAST_COMP_EXPIRY)
2024-12-01 00:58:56,723 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000147BE04019:alice:::- Starting new thread for updateLastCompExpiryTime

Scenario 3: Effect of Light Session Directory (LSD) on Posture Lease

1. Enabling or disabling LSD does not affect the posture lease and last compliance status as both of these attributes are stored in the Oracle DB and replicated across the deployment. Whereas, LSD stores limited EP attributes in the memory and replicates to other PSNs.

When LSD is enabled:

2. To enable LSD, navigate to Administration > System > Settings > Light Data Distribution > Check RADIUS Session Directory.

Enable LSD

3. EP connects for the first time and processes the posture check. Once the EP becomes compliant, it updates the posture lease and last known compliance attributes in the DB:

2024-12-02 19:36:43,274 DEBUG [PolicyEngineEvaluationThread-11][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 19:36:43,276 WARN [PolicyEngineEvaluationThread-11][[]] cisco.cpm.posture.runtime.PostureManager -:::::- Cannot find endpoint B4-96-91-26-EB-A1 in end point DB
2024-12-02 19:36:43,276 INFO [PolicyEngineEvaluationThread-11][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- not able to find user name in posture pip for B4-96-91-26-EB-A1 08C9C50A0000002B87B7D6EC. Set posture status to unknown

2024-12-02 19:37:27,164 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-5][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000227EB700E6::::- posture expriy time retrieved from DB is "" for B4-96-91-26-EB-A1



2024-12-02 19:37:29,110 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A0000002B87B7D6EC:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1733321249110 <--------------------Updated last known compliance status in DB



2024-12-02 19:37:29,113 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002B87B7D6EC:alice:::- posture_bypass_test is null fast reconnect expiry time is 1733234849113 2024-12-03T19:37:29.113+0530
2024-12-02 19:37:29,113 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002B87B7D6EC:alice:::- updating fast reconnect for end point B4:96:91:26:EB:A1 with 1 days of expiry time 1733234849113 <------Updated posture lease in DB

4. These are the attributes in LSD that are distributed across the PSN. You can see neither posture lease nor the last compliance status in the attributes:

2024-12-02 19:37:32,221 DEBUG [LSD-consumers-pool-28][[]] cisco.cpm.lsd.service.SessionDirectory -:::::- Updating session sessionID:[08C9C50A0000002B87B7D6EC] status:[Authenticated] randomId:[0352b361-e72a-40e7-a0c8-b1ef779f73a5] auditSessionID:[08C9C50A0000002B87B7D6EC] accountingSessionID:[null] endpointMAC:[B4-96-91-26-EB-A1] callingStationId: [B4-96-91-26-EB-A1] endpointIP:[10.197.201.180], IPv6 : [[]], psnIP:[10.127.197.170] psnFQDN: [labpsn01.vmlab.local] deviceIP:[10.197.201.8] destinationIP:[10.127.197.170] nasIP:[10.197.201.8] nasIPv6:[null] postureStatus: [Compliant] timeStamp:[1733148451] cts:security-group-tag:[7] cts:vn:[null] proxyFlow:[null] retry count : 1

5. Now, authenticate the EP with another PSN in the deployment. After the authentication request lands on another PSN, you can see PSN retrieves the posture lease time from the DB and marks the session directly as compliant. The same can be verified from the live logs:

2024-12-02 20:08:27,449 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-02 20:08:27,449 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 20:08:27,468 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Querying posture expiry time by MAC B4-96-91-26-EB-A1
2024-12-02 20:08:27,471 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture expriy time retrieved from DB is "1733234849113" for B4-96-91-26-EB-A1
2024-12-02 20:08:27,471 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture lease expiry time 1733234849113 2024-12-03T19:37:29.113+0530 for B4-96-91-26-EB-A1
2024-12-02 20:08:27,472 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- retrieved fast reconnect expiry time 1733234849113 2024-12-03T19:37:29.113+0530 for B4-96-91-26-EB-A1
2024-12-02 20:08:27,472 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- B4-96-91-26-EB-A1 is within fast reconnect expiry

PSN Marks Session as Compliant

When LSD is Disabled:

1. To disable LSD, navigate to Administration > System > Settings > Light Data Distribution > Uncheck RADIUS Session Directory.

Disable LSD

2. EP Connects for the first time and processes through the posture. Once the EP is compliant, it updates the posture lease and last known compliance attributes in the DB:

2024-12-02 20:40:10,417 DEBUG [PolicyEngineEvaluationThread-9][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 20:40:10,423 WARN [PolicyEngineEvaluationThread-9][[]] cisco.cpm.posture.runtime.PostureManager -:::::- Cannot find endpoint B4-96-91-26-EB-A1 in end point DB
2024-12-02 20:40:10,423 INFO [PolicyEngineEvaluationThread-9][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- not able to find user name in posture pip for B4-96-91-26-EB-A1 08C9C50A0000003087F1EE30. Set posture status to unknown



2024-12-02 20:40:45,679 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A0000002E87E4FE87:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1733325045679<--------------------Updated last known compliance status in DB (LAST_COMP_EXPIRY)



2024-12-02 20:40:45,682 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002E87E4FE87:alice:::- posture_bypass_test is null fast reconnect expiry time is 1733238645682 2024-12-03T20:40:45.682+0530
2024-12-02 20:40:45,682 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002E87E4FE87:alice:::- updating fast reconnect for end point B4:96:91:26:EB:A1 with 1 days of expiry time 1733238645682<------Updated posture lease in DB (EDF_POSTUREEXPIRY)

3. Now, authenticate the EP with another PSN in the deployment. Once the authentication request lands on another PSN, you can see the PSN retrieve the posture lease time from the DB and it marks the session directly as compliant. You can verify this from the live logs:

2024-12-02 20:49:56,115 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-02 20:49:56,115 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 20:49:56,119 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Querying posture expiry time by MAC B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture expriy time retrieved from DB is "1733238645682" for B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture lease expiry time 1733238645682 2024-12-03T20:40:45.682+0530 for B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- retrieved fast reconnect expiry time 1733238645682 2024-12-03T20:40:45.682+0530 for B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- B4-96-91-26-EB-A1 is within fast reconnect expiry

Final Posture Status

From these two scenarios, you can confirm that LSD does not affect the Posture Lease.

Frequently Asked Questions

Q: Are both Posture Lease and Cached Last Known Posture independent of each other?

A: Yes, Posture Lease can be enabled without enabling the Cached Last Known Posture and vice versa. Posture Lease saves the Endpoint Compliance statue as an endpoint attribute for the configured amount of time. Cached Last Known Posture is the time saved in the DB during which the Grace Period is given if the endpoint becomes non-compliant (this is not an endpoint attribute.)

Q: Are both the Posture Lease and Cached Last Known Posture replicated across the nodes?

A: Posture Lease is an endpoint attribute and is replicated across all nodes. Cached Last Known Posture is not an endpoint attribute, however, the value is in Oracle DB, and is also replicated to all nodes.

Q: Does rebooting of the node remove these values?

A: No, as both are saved in the Oracle DB and reloading of these nodes does not remove the values.

Q: Does Posture Lease cause any security issue?

A: When posture lease is enabled, ISE does not check for the posture status of the endpoint. It can cause a security issue if the endpoint is not compliant, and ISE can treat it as complaint. It is recommended to use Posture Reassessment along with the Posture Lease to minimize this risk.

Known Defects

  • Cisco bug ID CSCwk07454 - PSN does not update the DB with the correct Posture Lease expiry time
  • Cisco bug ID CSCwi58421 - PSN node not update the DB with the correct Posture expiry time when Posture Lease is enabled

Revision History

Revision Publish Date Comments
2.0
19-Aug-2026
Updated Introduction, spelling, grammar, inserted horizontal lines to separate sections for readability, fixed URLs, and CCW errors.
1.0
20-Mar-2025
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Swajal Sarkar
    Technical Consulting Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products