Implement and Configure ISE Posture Policy Grace Period and Hotfix

Available Languages

Download Options

  • PDF     (5.2 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (82.3 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (67.0 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 7, 2026
Document ID:226407

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Issue

A request was made for access to a pre-release hotfix or interim engineering build for Cisco ISE 3.4 to validate the fix for defect Cisco bug ID CSCwo52494, which addresses applying an individual grace period per posture policy. The fix was planned for inclusion in ISE 3.4 Patch 8, but validation was needed prior to official patch availability on an environment currently running ISE 3.4 Patch 4.

The specific issue being addressed by Cisco bug ID CSCwo52494 was that ISE was incorrectly sending the maximum grace period value even when the posture policy was successful, rather than only sending the maximum grace period value from failed posture policies as expected.

Environment

  • Cisco Identity Services Engine (ISE) 3.4

  • ISE Posture functionality

  • Current software version: ISE 3.4 Patch 4

  • Target software version: ISE 3.4 Patch 8 (for official fix)

  • Defect reference: Cisco bug ID CSCwo52494

Resolution

A hotfix was provided to address the ISE posture policy grace period issue. The hotfix corrected the behavior where ISE was incorrectly sending the maximum grace period value even when posture policies were successful.

Hotfix Implementation Results

After installing the hotfix, ISE now correctly sends the maximum grace period value from the failed posture policies, which is the expected behavior. The system now properly implements this logic:

  • When a device matches multiple posture policies, each with a different grace period, the device receives the maximum grace period configured among the failed policies.

  • If 2 failed policies exist, ISE picks the maximum grace period in the 3.4 version.

Additional Enhancement Information

For environments requiring more granular control over grace period selection, an additional enhancement was identified. A new UI tile setting in the Posture General Settings page that allows administrators to choose between using the maximum or minimum grace period among the posture policies that failed is available from ISE 3.5 Patch 1 onwards. This feature cannot be backported to 3.4 versions using patches and is tracked under Cisco bug ID CSCwr60808.

Cause

The root cause was identified as ISE incorrectly sending the maximum grace period value even when posture policies were successful. The expected behavior is for ISE to only send the maximum grace period value from failed posture policies. This behavior was addressed by Cisco bug ID CSCwo52494.

Related Content

Revision History

Revision Publish Date Comments
1.0
07-Oct-2026
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Praveenkumar Palanisamy
    Technical Consulting Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products