The following table describes the fields in the NAC or AnyConnect Posture Profile page, which allows you to configure parameters for the posture agent (AnyConnect and Cisco NAC Agent). The navigation path for this page is Policy > Policy Elements > Results > Client Provisioning > Resources > Add > NAC or AnyConnect Posture Profile.

Note	Merge parameter values with existing agent profile settings or overwrite them to appropriately configure agent behavior on Windows and Mac OS X clients.

Note

Agent log files are stored in a directory on the client machine. After the first login session, two files reside in the directory: one backup file from the previous log in session, and one new file containing login and operation from the current session. If the log file for the current session grows beyond the specified file size, the first segment of agent login and operation information automatically becomes the backup file in the directory. and the agent continues to record the latest entries in the current session file.

Problem

The client machine browser displays a “no policy matched” error message after user authentication and authorization. This issue applies to user sessions during the client provisioning phase of authentication.

Possible Causes

The client provisioning policy is missing required settings.

Posture Agent Download Issues

Remember that downloading the posture agent installer requires the following:

• The user must allow the ActiveX installer in the browser session the first time an agent is installed on the client machine. (The client provisioning download page prompts for this.)

• The client machine must have Internet access.

Resolution

• Ensure that a client provisioning policy exists in Cisco ISE. If yes, verify the policy identity group, conditions, and type of agent(s) defined in the policy. (Also ensure whether or not there is any agent profile configured under Policy > Policy Elements > Results > Client Provisioning > Resources > Add > NAC or AnyConnect Posture Profile, even a profile with all default values.)

• Try re-authenticating the client machine by bouncing the port on the access switch.

Cisco ISE supports coexistence of AnyConnect and legacy Cisco ISE NAC agents on Windows and Mac OS x clients. Agents start the posture discovery probe only when there is any change in the network on the clients. Cisco ISE responds to the client's posture discovery probe based on the client provisioning policy and the corresponding agent will get the discovery response, which results in only one agent being active.

Based on the client provisioning policy, Cisco ISE differs in responding to the agents posture discovery probe as below:

• If the endpoint is configured to use the legacy agent (Cisco ISE NAC agent for Windows and Mac OS x), the agent receives the discovery response with a string "X-perfigo-CAS=FQDN" in the existing format. AnyConnect stops discovery, if the discovery response is received for the legacy agent.

• If the endpoint is configured to use AnyConnect, Cisco ISE responds in a different format. This will be the Cisco ISE Policy Service node FQDN and the AnyConnect Configuration URL, AnyConnect package location and version based on the client provisioning policy. The legacy agent stops discovery, if the response is received for AnyConnect.

Problem

A client machine is granted “Temporary Access” to the network following login and authentication, but administrator and users expect full network access.

Possible Causes

This issue is applicable to any client machine login session using an agent to connect.

If the Cisco NAC Agent is running on the client and:

• The interface on the client machine goes down

• The session is terminated

Resolution

The user must try to verify network connectivity and then try to log in again (and pass through posture assessment, as well) to attempt to reestablish the connection.

Problem

The user is presented with a “Clean access server not available” message. This issue applies to any agent authentication session from Cisco ISE.

Possible Cause

This error could mean that either the session has terminated or Cisco ISE is no longer reachable on the network.

Resolution

• The user can try to log into the network again.

• The user can try to ping the default gateway or the RADIUS server IP address or FQDN supplied by the network administrator.

• The administrator can check network access attributes for the user (like the assigned VLAN, ACLs, routing, execute the nslookup command on the client, client machine DNS connection, and so on).

The Cisco NAC Agent installs to C:\Program Files\Cisco\Cisco NAC Agent\ on the Windows client.

You can uninstall the agent in the following ways:

• By double-clicking the Uninstall Cisco NAC Agent desktop icon.

• By going to Start Menu > Programs > Cisco Systems > Cisco Clean Access > Uninstall Cisco NAC Agent

• By going to Start Menu > Control Panel > Add or Remove Programs > Cisco NAC Agent and uninstall the Cisco NAC Agent.

You can uninstall Cisco NAC Agent in a Windows 8 client in Metro mode.

In Cisco NAC Agent scenarios where the user does not get network access, like "Remediation Failed" or "Network Access expired", the Agent displays the following toast notification:Network not available, Click "OK" to continue.

To get more details, you can select the toast and you will be redirected to Desktop mode and the Cisco NAC agent dialog is displayed.

Toast Notification is displayed for all positive recommended actions that the user needs to perform to gain network access. The following are some examples:

• For Network Acceptance policy, toast will be displayed as: "Click Accept to gain network access"

• For Agent/Compliance Module Upgrade, toast will be displayed as: "Click OK to Upgrade/Update"

• In the "user logged out" event, when "Auto Close" option for Logoff is not enabled in Clean Access Manager (CAM), toast notification is provided. This toast enables the users to know that they have been logged out and that they need to login again to get network access.

You can uninstall the Cisco NAC Agent for Mac OS X clients by running the uninstall script as follows:

Cisco NAC Agent Login—Default Screen

You can customize the default elements in the login screen on the Cisco NAC Agent. Once you have customized these elements, you then combine them with an “updateFeed.xml” XML descriptor file in the Agent login customization package to upload to Cisco ISE.

Cisco NAC Agent Login—Customized Screen

Windows client users see the customized login screen when they access your network via the Cisco NAC Agent. You can replace the Cisco logo that appears in the Cisco NAC Agent login screen with your corporate/company logo. You can modify the nac_login.xml file replacing the default Cisco logo with your own corporate/company logo in the form of a .gif file named “nac_logo.gif file,” and creating one or more “nacStrings_xx.xml” files. Be sure the image is a .gif file, not exceeding 67 x 40 pixels. Be sure to name the image “nac_logo.gif.”

The nac_login.xml file is one of the files that is required in your Agent login customization package, which allows you to customize the logo, fields, and message text contained in a Cisco NAC Agent login dialog to suit your specific Windows client network access requirements.

Use the following template to construct an appropriate “nac_login.xml” file to customize the logo, fields, and message text contained in a Cisco NAC Agent login screen.

The following example shows customized text in boldface.

<tr class="nacLoginMiddleSectionContainerInput">
   <td colspan="2">
      <fieldset width="100%" id="nacLoginCustomAlert" 
                style="display:block" class="nacLoginAlertBox">
          <table width="100%">
             <tr>
                <td id="nacLoginCustomAlert.img" valign="top" width="32px">
                  <img src="./cues_icons/Status_warning_icon.png" align="absmiddle" 
																		onload="cuesFixPNG(null,this)"></img>
                </td>
                <td id="nacLoginCustomAlert.content" class="nacLoginAlertText">
                  <cues:localize key="login.customalert"/>
                </td>
              </tr>
          </table>
       </fieldset>
    </td>
</tr>
<tr id="nacLoginRememberMe" style="visibility:hidden">
    <td>
       <cues:localize key="cd.nbsp"/>
    </td>
    <td class="cuesLoginField">
      <nobr>
      <input type="checkbox" alt="" title="" name="rememberme"
             id="rememberme" checked="true"/>
            <cues:localize key="login.remember_me"/>
      </nobr>
    </td>
</tr>

This is one of the files that is required in your Agent login customization package, allows you to customize the logo, fields, and message text contained in a Cisco NAC Agent login dialog to suit your specific Windows client network access requirements.

Use the following template to construct a one or more nacStrings_xx.xml files, where the xx is a two-character identifier for the specific language.

The following example shows customized text in boldface.

<cueslookup:name key="login.productname"> XYZ Co Inc. </cueslookup:name>
<cueslookup:name key="login.version">Version</cueslookup:name>
<cueslookup:name key="login.username"> Enter your username (same as your VPN) 
</cueslookup:name>
<cueslookup:name key="login.password">Enter your password (VPN password)</cueslookup:name>
<cueslookup:name key="login.remember_me">Remember Me</cueslookup:name>
<cueslookup:name key="login.server">Server</cueslookup:name>
<cueslookup:name key="login.customalert">Do not allow anyone else to use this PC
</cueslookup:name>
<cueslookup:name key="login.Too many users using this account">This account is already active 
on another device</cueslookup:name>
<cueslookup:name key="login.differentuser">Login as Different User</cueslookup:name>
<cueslookup:name key="login.removeoldest">Remove Oldest Login Session</cueslookup:name>

Note	There is no limit to the number of characters you can use for the customized text. However, Cisco recommends restricting the length so that these fields do not take up too much space in the resulting customized login screen as it appears on the client.

<cueslookup:name key="dp.status.fullNetAccess">Full Network Access</cueslookup:name> 
<cueslookup:name key="dp.status.fullNetAccess.verbose">Your device conforms with all the security policies for this protected network</cueslookup:name> 
<cueslookup:name key="dp.status.fullNetAccessWarn.verbose">Only optional requirements are failing. It is recommended that you update your system at your earliest convenience.</cueslookup:name> 
<cueslookup:name key="dp.status.iprefresh.progress.verbose">Refreshing IP address. Please Wait ...</cueslookup:name> 
<cueslookup:name key="dp.status.iprefresh.complete.verbose">Refreshing IP address succeeded.</cueslookup:name> 
<cueslookup:name key="dp.status.vlanchange.progress.verbose">Connecting to protected Network. Please Wait ...</cueslookup:name> 
<cueslookup:name key="dp.status.guestNetAccess">Guest Network Access</cueslookup:name> 
<cueslookup:name key="dp.status.noNetAccess">Network Access Denied</cueslookup:name>
<cueslookup:name key="dp.status.noNetAccess.verbose">There is at least one mandatory requirement failing. You are required to update your system before you can access the network.
</cueslookup:name><cueslookup:name key="dp.status.rejectNetPolicy.verbose">Network Usage Terms and Conditions are rejected. You will not be allowed to access the network.</cueslookup:name> 
<cueslookup:name key="dp.status.RestrictedNetAccess">Restricted Network Access granted.</cueslookup:name> 
<cueslookup:name key="dp.status.RestrictedNetAccess.verbose">You have been granted restricted network access because your device did not conform with all the security policies for this protected network and you have opted to defer updating your system. It is recommended that you update your system at your earliest convenience.</cueslookup:name> 
<cueslookup:name key="dp.status.temporaryNetAccess">Temporary Network Access</cueslookup:name> 
<cueslookup:name key="dp.status.temporaryNetAccess.bepatient.verbose">Please be patient while your system is checked against the network security policy.</cueslookup:name>
<cueslookup:name key="dp.status.pra.mandatoryfailure">Performing Re-assessment</cueslookup:name> 
<cueslookup:name key="dp.status.pra.mandatoryfailure.verbose">There is at least one mandatory requirement failing. You are required to update your system otherwise your network access will be restricted.</cueslookup:name> 
<cueslookup:name key="dp.status.pra.optionalfailure">Performing Re-assessment</cueslookup:name> 
<cueslookup:name key="dp.status.pra.optionalfailure.verbose">Only optional requirements are failing. It is recommended that you update your system at your earliest convenience.</cueslookup:name> 
<cueslookup:name key="dp.status.SessionTimeout">Logged out</cueslookup:name> 
<cueslookup:name key="dp.status.SessionTimeout.verbose">Temporary Access to the network has expired.</cueslookup:name> 
<cueslookup:name key="dp.status.Unauthenticated">Logged out</cueslookup:name> 
<cueslookup:name key="dp.status.Unauthenticated.verbose"> </cueslookup:name> 

This is one of the files that is required in your Agent login customization package, which allows you to customize the logo, fields, and message text contained in a Cisco NAC Agent login dialog to suit your specific Windows client network access requirements.

Before you can complete your Agent login customization package, you must construct a suitable updateFeed.xml XML descriptor file. Use the following example as a template to set up the updateFeed.xml descriptor file required for your customization package.

<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:update="http://www.cisco.com/cpm/update/1.0">
   <title>Provisioning Update</title>
   <updated>2011-12-21T12:00:00Z</updated>
   <id>https://www.cisco.com/web/secure/pmbu/provisioning-update.xml</id>
   <author>
      <name>Cisco Support</name>
      <email>support@cisco.com</email>
   </author>

   <!-- Custom Branding -->
      <entry>
         <id>http://foo.foo.com/foo/AgentCustomizationPackage/1/1/1/1</id> 
           -- This id can be anything, but should be unique within an ISE deployment
         <title>Agent Customization Package</title>
         <updated>2010-06-07T12:00:00Z</updated>
         <summary>This is the agent customization package </summary> - Can be anything
         <link rel="enclosure" type="application/zip" href="brand-windows.zip" length="18884" />
         <update:type>AgentCustomizationPackage</update:type>
         <update:version>1.1.1.0</update:version> -- Important to have this as 4 digit
         <update:os>Win</update:os>
      </entry>
</feed>

<?xml version="1.0" ?>
<cfg>
   <VlanDetectInterval>0</VlanDetectInterval>
   <RetryDetection>3</RetryDetection>
   <PingArp>0</PingArp>
   <PingMaxTimeout>1</PingMaxTimeout>
   <EnableVlanDetectWithoutUI>0</EnableVlanDetectWithoutUI>
   <SignatureCheck>0</SignatureCheck>
   <DisableExit>0</DisableExit>
   <PostureReportFilter>displayFailed</PostureReportFilter>
   <BypassSummaryScreen>1</BypassSummaryScreen>
   <LogFileSize>5</LogFileSize>
   <DiscoveryHost></DiscoveryHost>
   <DiscoveryHostEditable>1</DiscoveryHostEditable>
   <Locale>default</Locale>
   <AccessibilityMode>0</AccessibilityMode>
   <SwissTimeout>1</SwissTimeout>
   <HttpDiscoveryTimeout>30</HttpDiscoveryTimeout>
   <HttpTimeout>120</HttpTimeout>
   <ExceptionMACList></ExceptionMACList>
   <GeneratedMAC></GeneratedMAC>
   <AllowCRLChecks>1</AllowCRLChecks>
   <DisableL3SwissDelay>0</DisableL3SwissDelay>
   <ServerNameRules></ServerNameRules>
</cfg>

Note	This file also contains two static (that is, uneditable by the user or Cisco ISE administrator) “AgentCfgVersion” and “AgentBrandVersion” parameters used to identify the current version of the agent profile and agent customization file, respectively, on the client.

For client machines, configure which agent type, compliance module, agent customization package, and/or profile to make available and provision for users to download and install on the client machine.

Employees can connect their personal devices to the network directly using native supplicants, which are available for Windows, Mac OS, iOS, and Android devices. For personal devices, specify which Native Supplicant configuration to make available and provision on the registered personal device.