Cisco Identity Services Engine Administrator Guide, Release 2.3

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Identity Services Engine Administrator Guide, Release 2.3

Chapter Title

Configure Client Posture Policies

Results

Updated:
August 1, 2018

Chapter: Configure Client Posture Policies

Configure Client Posture Policies

Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the state, also known as posture, of all the endpoints that are connecting to a network for compliance with corporate security policies. This allows you to control clients to access protected areas of a network.

Posture Service

Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the compliance, also known as posture, of endpoints, before allowing them to connect to your network. A posture agent, such as the AnyConnect ISE Posture Agent, runs on the endpoint. Client Provisioning ensures that the endpoints receive the appropriate Posture Agent.

The ISE Posture Agent for Cisco ISE does not support Windows Fast User Switching when using the native supplicant, because there is no clear disconnect of the previous user. When a new user is sent, the Agent is hung on the old user process and session ID, so a new posture session cannot start. As per the Microsoft Security policies, it is recommended to disable Fast User Switching.


Note

In ISE, session control is done on multiple nodes.

On an MnT node, sessions are removed:

  • If there was accounting start, but no accounting stop (stale session), the session is removed in five days.

  • If there was accounting start followed by accounting stop, the session is removed in a few hours.

  • If there was no accounting start or stop, the session is removed in a few hours.

On a PSN node, sessions are removed:

  • When accounting stop is received.

  • When the session cache is cleared, especially when there are many sessions, or you reload the PSN.

If posture without redirection is used in multinode deployment, and sessions are not properly managed, it may impact the posture functionality.

ISE Community Resource

Configure ISE 2.1 and AnyConnect 4.3 Posture USB Check

How To Configure Posture with AnyConnect Compliance Module and ISE 2.0

Components of Posture Services

Cisco ISE posture service primarily includes the posture administration services and the posture run-time services.

Posture Administration Services

If you have not registered the Cisco ISE Apex license in Cisco ISE, then the posture administration services option is not available in the Cisco ISE administration portal.

Administration services provide the back-end support for posture-specific custom conditions and remediation actions that are associated with the requirements and authorization policies that are configured for posture service.

Posture Run-Time Services

The posture run-time services encapsulate all the interactions that happen between the client agent and the Cisco ISE server for posture assessment and remediation of clients.

Posture run-time services begin with the Discovery Phase. An endpoint session is created after the endpoint passes 802.1x authentication. The client agent then attempts to connect to a Cisco ISE node by sending discovery packets through different methods in the following order:

  1. via HTTP to Port 80 on a Cisco ISE server (if configured)

  2. via HTTPS to Port 8905 on a Cisco ISE server (if configured)

  3. via HTTP to Port 80 on the default gateway

  4. via HTTPS to Port 8905 to each previously contact server

  5. via HTTP to Port 80 on enroll.cisco.com

The Posture Phase begins when the Acceptable User Policy (if any) is accepted. The Cisco ISE node issues a posture token for the Posture Domain to the client agent. The posture token allows the endpoint to reconnect to the network without going through the posture process again. It contains information such as the Agent GUID, the Acceptable User Policy status, and endpoint operating system information.

The messages used in the Posture Phase are in the NEA PB/PA format (RFC5792).

Posture and Client-Provisioning Policies Workflow

Figure 1. Posture and Client Provisioning Policies Workflow in Cisco ISE

In Stage 1 of posture discovery, all discovery probes execute at the same time by the Posture agent. The timeout value is 5 seconds. Stage two contains two discovery probes, which allows the posture module to establish a connection to the PSN. This connection to the PSN supports authentication in environments where redirection is not supported. During stage two, all probes are sequential. If stage 2 fails, the posture agent tries stage 1 again. This cycle continues for 30 seconds, after which you see "No policy server detected". This state continues until a discovery probe triggers.

Posture Service Licenses

Cisco ISE provides you with three types of licenses, the Base license, the Plus license, and the Apex license. If you have not installed the Apex license on the Primary PAN, then the posture requests will not be served in Cisco ISE. The posture service of Cisco ISE can run on a single node or on multiple nodes.

Posture Service Deployment

You can deploy Cisco ISE in a standalone environment (on a single node) or in a distributed environment (on multiple nodes).

In a standalone Cisco ISE deployment, you can configure a single node for all the administration services, the monitoring and troubleshooting services, and the policy run-time services.

In a distributed Cisco ISE deployment, you can configure each node as a Cisco ISE node for administration services, monitoring and troubleshooting services, and policy run-time services. A node that runs the administration services is the primary node in that Cisco ISE deployment. The other nodes that run other services are the secondary nodes which can be configured for backup services for one another.

Enable Posture Session Service in Cisco ISE

Before you begin
  • You must enable session services in Cisco ISE and install the advanced license package to serve all the posture requests received from the clients.

  • If you have more than one node that is registered in a distributed deployment, all the nodes that you have registered appear in the Deployment Nodes page, apart from the primary node. You can configure each node as a Cisco ISE node (Administration, Policy Service, and Monitoring personas).

  • The posture service only runs on Cisco ISE nodes that assume the Policy Service persona and does not run on Cisco ISE nodes that assume the administration and monitoring personas in a distributed deployment.

Procedure
Step 1

Choose Administration > System > Deployment > Deployment.

Step 2

Choose a Cisco ISE node from the Deployment Nodes window.

Step 3

Click Edit.

Step 4

Under the General Settings tab, check the Policy Service check box,

If the Policy Service check box is unchecked, both the session services and the profiling service check boxes are disabled.

Step 5

Check the Enable Session Services check box, for the Policy Service persona to run the Network Access, Posture, Guest, and Client Provisioning session services. To stop the session services, uncheck the check box.

Step 6

Click Save.

Run the Posture Assessment Report

You can run the Posture Detail Assessment report to generate a detailed status of compliance of the clients against the posture policies that are used during posture assessment.

Procedure

Step 1

Choose Operations > Reports > ISE Reports > Endpoints and Users > Posture Detail Assessment.

Step 2

From the Time Range drop-down list, choose the specific time period.

Step 3

Click Run to view the summary of all the end points that were active during the selected time period.

Posture Administration Settings

You can globally configure the Admin portal for posture services. You can download updates automatically to the Cisco ISE server through the web from Cisco. You can also update Cisco ISE manually offline later. In addition, having an agent like AnyConnect, the NAC Agent, or the Web Agent installed on the clients provides posture assessment and remediation services to clients. The client agent periodically updates the compliance status of clients to Cisco ISE. After login and successful requirement assessment for posture, the client agent displays a dialog with a link that requires end users to comply with terms and conditions of network usage. You can use this link to define network usage information for your enterprise network that end users accept before they can gain access to your network.

Timer Settings for Clients

You can set up timers for users to remediate, to transition from one state to another, and to control the login success screen.

However, when there are no agent profiles configured to match the client provisioning policies, you can use the settings in the General Settings configuration window ( Administration > System > Settings > Posture > General Settings).

Set Remediation Timer for Clients to Remediate Within Specified Time

You can configure the timer for client remediation within a specified time. When clients fail to satisfy configured posture policies during an initial assessment, the agent waits for the clients to remediate within the time configured in the remediation timer. If the client fails to remediate within this specified time, then the client agent sends a report to the posture run-time services after which the clients are moved to the noncompliance state.

Procedure
Step 1

Choose Administration > System > Settings > Posture > General Settings.

Step 2

In the Remediation Timer field, enter a time value in minutes.

The default value is 4 minutes. The valid range is 1–300 minutes.

Step 3

Click Save.

Set Network Transition Delay Timer for Clients to Transition

You can configure the timer for clients to transition from one state to the other state within a specified time using the network transition delay timer, which is required for Change of Authorization (CoA) to complete. It may require a longer delay time when clients need time to get a new VLAN IP address during success and failure of posture. When successfully postured, Cisco ISE allows clients to transition from unknown to compliant mode within the time specified in the network transition delay timer. Upon failure of posture, Cisco ISE allows clients to transition from unknown to noncompliant mode within the time specified in the timer.

Procedure
Step 1

Choose Administration > System > Settings > Posture > General Settings.

Step 2

Enter a time value in seconds, in the Network Transition Delay field.

The default value is 3 seconds. The valid range is 2 to 30 seconds.

Step 3

Click Save.

Set Login Success Window to Close Automatically

After successful posture assessment, the client agent displays a temporary network access screen. The user needs to click the OK button in the login window to close it. You can set up a timer to close this login screen automatically after specified time.

Procedure
Step 1

Choose Administration > System > Settings > Posture > General Settings.

Step 2

Check the Automatically Close Login Success Screen After check box.

Step 3

Enter a time value in seconds, in the field next to Automatically Close Login Success Screen After check box.

The valid range is 0 to 300 seconds. If the time is set to zero, then AnyConnect does not display the login success screen.

Step 4

Click Save.

Set Posture Status for Nonagent Devices

You can configure the posture status of endpoints that run on non-agent devices. When Android devices and Apple devices such as an iPod, iPhone, or iPad connect to a Cisco ISE enabled network, these devices assume the Default Posture Status settings.

These settings can also be applied to endpoints that run on Windows and Macintosh operating systems when a matching client provisioning policy is not found during posture runtime while redirecting the endpoints to the client provisioning portal.

Before you begin

In order to enforce policy on an endpoint, you must configure a corresponding Client Provisioning policy (Agent installation package). Otherwise, the posture status of the endpoint automatically reflects the default setting.

Procedure

Step 1

Choose Administration > System > Settings > Posture > General Settings.

Step 2

From the Default Posture Status drop-down list, choose the option as Compliant or Noncompliant.

Step 3

Click Save.

Posture Lease

You can configure Cisco ISE to perform posture assessment every time a user logs into your network or perform posture assessment in specified intervals. The valid range is from 1 to 365 days.

This configuration applies only for those who use AnyConnect agent for posture assessment.

When the posture lease is active, Cisco ISE will use the last known posture state and will not reach out to the endpoint to check for compliance. But when the posture lease expires, Cisco ISE does not automatically trigger a re-authentication or a posture reassessment for the endpoint. The endpoint will stay in the same compliance state since the same session is being used. When the endpoint re-authenticates, posture will be run and the posture lease time will be reset.

Example Use Case Scenario:

  • The user logs on to the endpoint and gets it posture compliant with the posture lease set to one day.

  • Four hours later the user logs off from the endpoint (the posture lease now has 20 hours left).

  • One hour later the user logs on again. Now the posture lease has 19 hours left. The last know posture state was compliant. Hence the user is provided access without posture being run on the endpoint.

  • Four hours later the user logs off (the posture lease now has 15 hours left).

  • 14 hours later, the user logs on. The posture lease has one hour left. The last known posture state was compliant. The user is provided access without posture being run on the endpoint.

  • One hour later, the posture lease expires. The user is still connected to the network as the same user session is being used.

  • One hour later, user logs off (the session is tied to the user but not to the machine, so the machine can stay on the network).

  • One hour later the user logs on. Since the posture lease has expired and a new user session is launched, the machine performs a posture assessment, the results are sent to the Cisco ISE and the posture lease timer is reset to one day in case of this use case.

Periodic Reassessments

Periodic reassessment (PRA) can be done only for clients that are already successfully postured for compliance. PRA cannot occur if clients are not compliant on your network.

A PRA is valid and applicable only if the endpoints are in a compliant state. The policy service node checks the relevant policies, and compiles the requirements depending on the client role that is defined in the configuration to enforce a PRA. If a PRA configuration match is found, the policy service node responds to the client agent with the PRA attributes that are defined in the PRA configuration for the client before issuing a CoA request. The client agent periodically sends the PRA requests based on the interval specified in the configuration. The client remains in the compliant state if the PRA succeeds, or the action configured in the PRA configuration is to continue. If the client fails to meet PRA, then the client is moved from the compliant state to the noncompliant state.

The PostureStatus attribute shows the current posture status as compliant in a PRA request instead of unknown even though it is a posture reassessment request. The PostureStatus is updated in the Monitoring reports as well.

When the posture lease has not expired, an endpoint becomes compliant based on the Access Control List (ACL), and PRA is initiated. If PRA fails, the endpoint is deemed noncompliant and the posture lease is reset.


Note

PRA is not supported during PSN failover. After PSN failover, you must either enable rescan on the client or enable posture lease.

Configure Periodic Reassessments

You can configure periodic reassessments only for clients that are already successfully postured for compliance. You can configure each PRA to a user identity group that is defined in the system.

Before you begin

  • Ensure that each Periodic reassessment (PRA) configuration has a unique group or a unique combination of user identity groups assigned to the configuration.

  • You can assign a role_test_1 and a role_test_2, which are the two unique roles to a PRA configuration. You can combine these two roles with a logical operator and assign the PRA configuration as a unique combination of two roles. For example, role_test_1 OR role_test_2.

  • Ensure that two PRA configurations do not have a user identity group in common.

  • If a PRA configuration already exists with a user identity group Any, you cannot create other PRA configurations unless you perform one of the following:

    • Update the existing PRA configuration with the Any user identity group to reflect a user identity group other than Any.

    • Delete the existing PRA configuration with a user identity group “Any”.

Procedure
Step 1

Choose Administration > System > Settings > Posture > Reassessments.

Step 2

Click Add.

Step 3

Modify the values in the New Reassessment Configuration window to create a new PRA.

Step 4

Click Submit to create a PRA configuration.

Download Posture Updates to Cisco ISE

Posture updates include a set of predefined checks, rules, and support charts for antivirus and antispyware for both Windows and Macintosh operating systems, and operating systems information that are supported by Cisco. You can also update Cisco ISE offline from a file on your local system, which contains the latest archives of updates.

When you deploy Cisco ISE on your network for the first time, you can download posture updates from the web. This process usually takes approximately 20 minutes. After the initial download, you can configure Cisco ISE to verify and download incremental updates to occur automatically.

Cisco ISE creates default posture policies, requirements, and remediations only once during an initial posture updates. If you delete them, Cisco ISE does not create them again during subsequent manual or scheduled updates.

Before you begin

To ensure that you are able to access the appropriate remote location from which you can download posture resources to Cisco ISE, you may be required to verify that you have the correct proxy settings configured for your network as described in Specifying Proxy Settings in Cisco ISE.

You can use the Posture Update window to download updates dynamically from the web.

Procedure

Step 1

Choose Administration > System > Settings > Posture > Updates.

Step 2

Choose the Web option to download updates dynamically.

Step 3

Click Set to Default to set the Cisco default value for the Update Feed URL field.

If your network restricts URL-redirection functions (via a proxy server, for example) and you are experiencing difficulty accessing the above URL, try also pointing your Cisco ISE to the alternative URL in the related topics.

Step 4

Modify the values in the Posture Updates window.

Step 5

Click Update Now to download updates from Cisco.

After being updated, the Posture Updates window displays the current Cisco updates version information as a verification of an update under Update Information section in the Posture Updates window.

Step 6

Click Yes to continue.

Download Posture Updates Automatically

After an initial update, you can configure Cisco ISE to check for the updates and download them automatically.

Before you begin

  • You should have initially downloaded the posture updates to configure Cisco ISE to check for the updates and download them automatically.

Procedure

Step 1

Choose Administration > System > Settings > Posture > Updates.

Step 2

In the Posture Updates window, check the Automatically check for updates starting from initial delay check box.

Step 3

Enter the initial delay time in hh:mm:ss format.

Cisco ISE starts checking for updates after the initial delay time is over.

Step 4

Enter the time interval in hours.

Cisco ISE downloads the updates to your deployment at specified intervals from the initial delay time.

Step 5

Click Save.

Configure Acceptable Use Policies for Posture Assessment

After login and successful posture assessment of clients, the client agent displays a temporary network access screen. This screen contains a link to an acceptable use policy (AUP). When the user clicks the link, they are redirected to a page that displays the network-usage terms and conditions, which they must read and accept.

Each Acceptable Use Policy configuration must have a unique user identity group, or a unique combination of user identity groups. Cisco ISE finds the AUP for the first matched user identity group, and then it communicates to the client agent that displays the AUP.

Procedure

Step 1

Choose Administration > System > Settings > Posture > Acceptable Use Policy.

Step 2

Click Add.

Step 3

Modify the values in the New Acceptable Use Policy Configuration window.

Step 4

Click Submit.

Posture Conditions

A posture condition can be any one of the following simple conditions: a file, a registry, an application, a service, or a dictionary condition. One or more conditions from these simple conditions form a compound condition, which can be associated to a posture requirement.

When you deploy Cisco ISE on your network for the first time, you can download posture updates from the web. This process is called the initial posture update.

After an initial posture update, Cisco ISE also creates Cisco defined simple and compound conditions. Cisco defined simple conditions have pc_ as their prefixes and compound conditions have pr_ as their prefixes.

You can also configure Cisco ISE to download the Cisco-defined conditions periodically as a result of dynamic posture updates through the web. You cannot delete or edit Cisco defined posture conditions.

A user defined condition or a Cisco defined condition includes both simple conditions and compound conditions.

Simple Posture Conditions

You can use the Posture Navigation pane to manage the following simple conditions:

  • File Conditions: A condition that checks the existence of a file, the date of a file, and the versions of a file on the client.

  • Registry Conditions: A condition that checks for the existence of a registry key or the value of the registry key on the client.

  • Application Conditions: A condition that checks if an application or process is running or not running on the client.


    Note

    If a process is installed and running, user is compliant. However, the Application condition works in reverse logic; If an application is not installed and not running, the end user is complaint. If an application is installed and running, the end user is non-complaint.

  • Service Conditions: A condition that checks if a service is running or not running on the client.

  • Dictionary Conditions: A condition that checks a dictionary attribute with a value.

  • USB Conditions: A condition that checks for the presence of USB mass storage device.

Create Simple Posture Conditions

You can create file, registry, application, service, and dictionary simple conditions that can be used in posture policies or in other compound conditions.

Before you begin

To perform the following task, you must be a Super Admin or Policy Admin.

Procedure

Step 1

Choose Policy > Policy Elements > Conditions > Posture.

Step 2

Choose any one of the following: File, Registry, Application, Service, or Dictionary Simple Condition.

Step 3

Click Add.

Step 4

Enter the appropriate values in the fields.

Step 5

Click Submit.

Compound Posture Conditions

Compound conditions are made up of one or more simple conditions, or compound conditions. You can make use of the following compound conditions while defining a Posture policy.

  • Compound Conditions: Contains one or more simple conditions, or compound conditions of the type File, Registry, Application, or Service condition

  • Antivirus Compound Conditions: Contains one or more AV conditions, or AV compound conditions

  • Antispyware Compound Conditions: Contains one or more AS conditions, or AS compound conditions

  • Dictionary Compound Conditions: Contains one or more dictionary simple conditions or dictionary compound conditions

  • Antimalware Conditions: Contains one or more AM conditions.

Predefined Condition for Enabling Automatic Updates in Windows Clients

The pr_AutoUpdateCheck_Rule is a Cisco predefined condition, which is downloaded to the Compound Conditions window. This condition allows you to check whether the automatic updates feature is enabled on Windows clients. If a Windows client fails to meet this requirement, then the Network Access Control (NAC) Agents enforce the Windows client to enable (remediate) the automatic updates feature. After this remediation is done, the Windows client becomes posture compliant. The Windows update remediation that you associate in the posture policy overrides the Windows administrator setting, if the automatic updates feature is not enabled on the Windows client.

Preconfigured Antivirus and Antispyware Conditions

Cisco ISE loads preconfigured antivirus and antispyware compound conditions in the AV and AS Compound Condition windows, which are defined in the antivirus and antispyware support charts for Windows and Macintosh operating systems. These compound conditions can check if the specified antivirus and antispyware products exist on all the clients. You can also create new antivirus and antispyware compound conditions in Cisco ISE.

Antivirus and Antispyware Support Chart

Cisco ISE uses an antivirus and antispyware support chart, which provides the latest version and date in the definition files for each vendor product. Users must frequently poll antivirus and antispyware support charts for updates. The antivirus and antispyware vendors frequently update antivirus and antispyware definition files, look for the latest version and date in the definition files for each vendor product.

Each time the antivirus and antispyware support chart is updated to reflect support for new antivirus and antispyware vendors, products, and their releases, the Agents receive a new antivirus and antispyware library. It helps the Agents to support newer additions. Once the Agents retrieve this support information, they check the latest definition information from the periodically updated se-checks.xml file (which is published along with the se-rules.xml file in the se-templates.tar.gz archive), and determine whether clients are compliant with the posture policies. Depending upon what is supported by the antivirus and antispyware library for a particular antivirus, or antispyware product, the appropriate requirements will be sent to the Agents for validating their existence, and the status of particular antivirus and antispyware products on the clients during posture validation.

For more information on the antivirus and anti-malware products supported by the ISE posture agent, see the Cisco AnyConnect ISE Posture Support Charts: Cisco ISE Compatibility Guide.

You can verify the minimum compliance module version while creating an anti-malware posture condition. After the posture feed is updated, choose Work Centers > Posture > Policy Elements > Anti-Malware Condition and then choose the Operating System and Vendor to view the support chart.


Note

Some of the Anti-Malware endpoint security solutions (such as FireEye, Cisco AMP, Sophos, and so on) require network access to their respective centralized service for functioning. For such products, AnyConnect ISE posture module (or OESIS library) expects the endpoints to have internet connectivity. It is recommended that internet access is allowed for such endpoints during pre-posture for these online agents (if offline detection is not enabled). Signature Definition condition might not be applicable in such cases.

Compliance Module

The compliance module contains a list of fields, such as vendor name, product version, product name, and attributes provided by OPSWAT that supports Cisco ISE posture conditions.

Vendors frequently update the product version and date in the definition files, therefore, you must look for the latest version and date in the definition files for each vendor product by frequently polling the compliance module for updates. Each time the compliance module is updated to reflect the support for new vendors, products, and their releases, the AnyConnect agent receives a new library. It helps the AnyConnect agent to support newer additions. The AnyConnect agent retrieves this support information and checks the latest definition information from the periodically updated se-checks.xml file (which is published along with the se-rules.xml file in the se-templates.tar.gz archive), and determine whether clients are compliant with the posture policies. Depending upon what is supported by the library for a particular antivirus, antispyware, antimalware, disk encryption, or patch management product, the appropriate requirements will be sent to the AnyConnect agent for validating their existence, and the status of the particular products on the clients during posture validation.

The compliance module is available on Cisco.com.

Table given below lists the OPSWAT API versions that support and do not support the ISE posture policy. There are different policy rules for agents that support versions 3 and 4.

Table 1. OPSWAT API Versions

Posture Condition

Compliance Module Version

OPSWAT

Antivirus

3.x or earlier

Antispyware

3.x or earlier

Antimalware

4.x or later

Disk Encryption

3.x or earlier and 4.x or later

Patch Management

3.x or earlier and 4.x or later

USB

4.x or later

Non-OPSWAT

File

Any version

Application

Any version

Compound

Any version

Registry

Any version

Service

Any version


Note

  • Be sure to create separate posture policies for version 3.x or earlier and version 4.x or later, in anticipation of clients that may have installed any one of the above versions.

  • OESIS version 4 support is provided for compliance module 4.x and Cisco AnyConnect 4.3 and higher. However, AnyConnect 4.3 supports both OESIS version 3 and version 4 policies.

  • Version 4 compliance module is supported by ISE 2.1 and higher.

Create Compound Posture Conditions

You can create compound conditions that can be used in posture policies for posture assessment and validation.

Before you begin

To perform the following task, you must be a Super Admin or Policy Admin.

Procedure

Step 1

Choose Policy > Policy Elements > Conditions > Posture > Compound Conditions > Add.

Step 2

Enter appropriate values for the fields.

Step 3

Click Validate Expression to validate the condition.

Step 4

Click Submit.

Create Patch Management Conditions

You can create a policy to check the status of a selected vendor's patch management product.

For example, you can create a condition to check if Microsoft System Center Configuration Manager (SCCM), Client Version 4.x software product is installed at an endpoint.


Note
Supported versions of Cisco ISE and AnyConnect:

  • Cisco ISE version 1.4 and later

  • AnyConnect version 4.1 and later

Before you begin

To perform the following task, you must be a Super Admin or Policy Admin.

Procedure

Step 1

Choose Policy > Policy Elements > Conditions > Posture > Patch Management Condition.

Step 2

Click Add.

Step 3

Enter the condition name and description in the Name and Description fields.

Step 4

Choose the appropriate operating system from the Operating System drop-down field.

Step 5

Choose the Compliance Module from the drop-down list.

Step 6

Choose the Vendor Name from the drop-down list.

Step 7

Choose the Check Type.

Step 8

Choose the appropriate patch from the Check patches installed drop-down list.

Step 9

Click Submit.

Create Disk Encryption Conditions

You can create a policy to check if an end point is compliant with the specified data encryption software.

For example, you can create a condition to check if the C: drive is encrypted in an end point. If the C: drive is not encrypted then the end point receives a non-compliance notification and ISE logs a message.

Before you begin

To perform the following task, you must be a Super Admin or Policy Admin. You can associate a Disk Encryption condition with a posture requirement only when you use the AnyConnect ISE posture agent.

Procedure

Step 1

Choose Policy > Policy Elements > Conditions > Posture > Disk Encryption Condition.

Step 2

Click Add.

Step 3

In the Disk Encryption Condition window, enter the appropriate values in the fields.

Step 4

Click Submit.

Configure Posture Policies

A posture policy is a collection of posture requirements that are associated with one or more identity groups and operating systems. The Dictionary Attributes are optional conditions that can be used along with the identity groups and the operating systems to define different policies for the devices.

See the section "Posture Policy" in ISE Posture Prescriptive Deployment Guide for more information.

Before you begin

  • You must understand the Acceptable Use Policy (AUP).

  • You must understand periodic reassessments (PRA).

Procedure

Step 1

Choose Policy > Posture or Work Centers > Posture > Posture Policy.

Step 2

Use the drop-down arrow to add a new policy.
Step 3

To edit the profile, either double-click a policy or click Edit at the end of the row.
Step 4

From the Rule Status drop-down list, choose Enabled or Disabled.

Step 5

(Optional) Drag the slider named Delayed Notification to delay the grace period prompt from being displayed to the user until a specific percentage of grace period has elapsed. For example, if the notification delay period is set to 50% and the configured grace period is 10 minutes, Cisco ISE checks the posture status after 5 minutes and displays the grace period notification if the endpoint is found to be noncompliant. Grace period notification is not displayed if the endpoint status is compliant. If the notification delay period is set to 0%, the user is prompted immediately at the beginning of the grace period to remediate the problem. However, the endpoint is granted access until the grace period expires. The default value for this field is 0%. The valid range is from 0 to 95%.

Step 6

In the Rule Name field, enter the name of the policy.

Note 

It is a best practice to configure a posture policy with each requirement as a separate rule in order to avoid unexpected results.

Step 7

From the Identity Groups column, select the desired identity group.

You can create posture policies based on user or end-point identity groups.
Step 8

From the Operating Systems column, select the operating system.

Step 9

From the Compliance Module column, select the required compliance module:

  • 4.x or Later: Supports antimalware, disk encryption, patch management, and USB conditions.

  • 3.x or Earlier: Supports antivirus, antispyware, disk encryption, and patch management conditions

  • Any Version—: upports file, service, registry, application, and compound conditions.

Step 10

From the Posture Type column, select the Posture Type.

  • AnyConnect—Deploys the AnyConnect agent to monitor and enforce Cisco ISE policies that require client interaction.

  • AnyConnect Stealth—Deploys the AnyConnect agent to monitor and enforce Cisco ISE posture policies without any client interaction.

  • Temporal Agent—A temporary executable file that is run on the client to check the compliance status.

Step 11

In Other Conditions, you can add one or more dictionary attributes and save them as simple or compound conditions to a dictionary.

Note 

The dictionary simple conditions and compound conditions that you create in the Posture Policy window are not displayed while configuring an authorization policy.

Step 12

Specify the requirements in the Requirements field.

Step 13

Click Save.

Configure AnyConnect Workflow

To configure the AnyConnect agent, perform the following steps in Cisco ISE:

Procedure

Step 1

Create an AnyConnect agent profile.

Step 2

Create an AnyConnect configuration for AnyConnect packages.

Step 3

Create a client provisioning policy.
Step 4

(Optional) Create custom posture condition.
Step 5

(Optional) Create custom remediation action.
Step 6

(Optional) Create custom posture requirements.
Step 7

Create a posture policy.
Step 8

Configure the client provisioning policy.
Step 9

Create an authorization profile.
Step 10

Configure the authorization policies.
Step 11

Download and launch AnyConnect.

  1. Connect to the SSID.

  2. Launch a Browser and you will be redirected to the Client Provisioning Portal.

  3. Click Start. This checks if the AnyConnect agent is installed and running.

  4. Click This Is My First Time Here.

  5. Choose Click Here to Download and Launch AnyConnect.

  6. Save the Cisco Anyconnect .exe or .dmg file for Windows or Mac OSX respectively. For Windows, run the .exe file and for Mac OSX, double-click the .dmg file and run the app.


Note

Cisco ISE does not support ARM64 version of AnyConnect for AnyConnect posture flow. Ensure that you do not use the ARM64 version of AnyConnect in the client provisioning policy, otherwise it might cause failure on the client side. Restart the client if Anyconnect is not working properly because of this issue.

Prerequisite for Certificate-Based Conditions

Client Provisioning and Posture Policy rules may include conditions based on certificate attributes. A prerequisite for certificate-based conditions in either the Client Provisioning or Posture Policy is to ensure that there is s a matching Authorization Policy rule based on the same certificate attribute.

For example, you should use the same attribute as shown in the figures, the Issuer – Common Name attribute is used in both Client Provisioning or posture and authorization policies.

Figure 2. Cisco Provisioning Policy
Figure 3. Conditions Studio

Note

ISE server certificate must be trusted in the System Certificate store for AnyConnect 4.6 MR2 and above. Any posture check or remediation that requires elevated privileges will not work if the server is untrusted.

  • Windows OS: The server certificate must be added to the System Certificate store.

  • MAC OS: The server certificate must be added to the System Keychain. It is recommended that you use the command-line utility to trust the certificate. Adding the certificate to the System Keychain using the Keychain Access app might not work if it is already present in the Login Keychain.

Default Posture Policies

Rule Name

Description

Requirements

Default_Antimalware_Policy_Mac

Checks if endpoints have any of the supported vendor’s antimalware software (that is recognized by AnyConnect) installed and running in their devices.

Any_AM_Installation

Default_Antimalware_Policy_Win

Checks if endpoints have any of the supported vendor’s antimalware software (that is recognized by AnyConnect) installed and running in their devices.

Any_AM_Installation_Win

Default_AppVis_Policy_Mac

Gathers information and reports all the applications that are installed on a given endpoint.

Default_AppVis_Requirement_Mac

Default_AppVis_Policy_Win

Gathers information and reports all the applications that are installed on a given endpoint.

Default_AppVis_Requirement_Win

Default_Firewall_Policy_Mac

Checks if endpoints have any of the supported vendor’s Firewall program (that is recognized by AnyConnect) installed.

Default_Firewall_Requirement_Mac

Default_Firewall_Policy_Win

Checks if endpoints have any of the supported vendor’s Firewall program (that is recognized by AnyConnect) installed.

Default_Firewall_Requirement_Win

Default_USB_Block_Win

Ensures that the endpoint device does not have any USB storage devices connected.

USB_Block

Posture Assessment Options

The following table provides a list of posture assessment (posture conditions) options that are supported by the Cisco ISE Posture Agents for Windows and Macintosh, and the Web Agent for Windows.

Table 2. Posture Assessment Options

ISE Posture Agent for Windows

Cisco Temporal Agent for Windows

ISE Posture Agent for Macintosh OS X

Cisco Temporal Agent for Macintosh OS X

Operating System/Service Packs/Hotfixes

—

—

—

Service Check

Service Check (Temporal agent 4.5 and ISE 2.3)

Service Check (AC 4.1 and ISE 1.4)

Daemon checks are not supported

Registry Check

Registry Check (Temporal agent 4.5 and ISE 2.3)

—

—

File Check

File Check (Temporal agent 4.5 and ISE 2.3)

File Check (AC 4.1 and ISE 1.4)

File Check (Temporal agent 4.5 and ISE 2.3)

Application Check

Application Check (Temporal agent 4.5 and ISE 2.3)

Application Check (AC 4.1 and ISE 1.4)

Application Check (Temporal agent 4.5 and ISE 2.3)

Antivirus Installation

Antimalware Installation

Antivirus Installation

Antimalware Installation

Antivirus Version/ Antivirus Definition Date

OPSWAT version 4 is used, hence no Antivirus/Antispyware support; only Antimalware is supported

Antivirus Version/ Antivirus Definition Date

OPSWAT version 4 is used, hence no Antivirus/Antispyware support; only Antimalware is supported

Antispyware Installation

OPSWAT version 4 is used, hence no Antivirus/Antispyware support; only Antimalware is supported

Antispyware Installation

OPSWAT version 4 is used, hence no Antivirus/Antispyware support; only Antimalware is supported

Antispyware Version/ Antispyware Definition Date

OPSWAT version 4 is used, hence no Antivirus/Antispyware support; only Antimalware is supported

Antispyware Version/ Antispyware Definition Date

OPSWAT version 4 is used, hence no Antivirus/Antispyware support; only Antimalware is supported

Patch Management Check (AC 4.1 and ISE 1.4)

Only Patch Management installation check

Patch Management Check (AC 4.1 and ISE 1.4)

—

Windows Update Running

—

—

—

Windows Update Configuration

—

—

—

WSUS Compliance Settings

—

—

—

Posture Remediation Options

The following table provides a list of posture remediation options that are supported by the Cisco ISE Posture Agents for Windows and Macintosh, and the Web Agent for Windows.

Table 3. Posture Remediation Options

ISE Posture Agent for

Windows

ISE Posture Agent for

Macintosh OS X

Message Text (Local Check)

Message Text (Local Check)

URL Link (Link Distribution)

URL Link (Link Distribution)

File Distribution

—

Launch Program

—

Antivirus Definition Update

Antivirus Live Update

Antispyware Definition Update

Antispyware Live Update

Patch Management Remediation (AC 4.1 - and ISE 1.4)

—

Windows Update

—

WSUS

—

ISE Community Resource

Cisco ISE and SCCM integration Reference Guide

Custom Conditions for Posture

A posture condition can be any one of the following simple conditions: a file, a registry, an application, a service, or a dictionary condition. One or more conditions from these simple conditions form a compound condition, which can be associated with a posture requirement.

After an initial posture update, Cisco ISE also creates Cisco-defined simple and compound conditions. Cisco-defined simple conditions use the pc_ as and compound conditions use pr_ as.

A user-defined condition or a Cisco-defined condition includes both simple and compound conditions.

Posture service makes use of internal checks based on antivirus and antispyware (AV/AS) compound conditions. Hence, posture reports do not reflect the exact AV/AS compound-condition names that you have created. The reports display only the internal check names of AV/AS compound conditions.

For example, if you have created an AV compound condition named "MyCondition_AV_Check" to check any Vendor and any Product, the posture reports will display the internal check, that is “av_def_ANY”, as the condition name, instead of "MyCondition_AV_Check".

Posture Endpoint Custom Attributes

You can use the posture endpoint custom attributes to create client provisioning and posture policies. You can create a maximum of 100 endpoint custom attributes. The following types of endpoint custom attributes are supported: Int, String, Long, Boolean, Float, IP, and Date.

Endpoint custom attributes can be used to allow or block devices based on certain attributes or to assign certain privileges based on the posture or client provisioning policies.

Create Posture Policy Using Endpoint Custom Attributes

To create a posture policy using endpoint custom attributes:

Procedure

Step 1

Create the endpoint custom attributes.

  1. Choose Administration > Identity Management > Settings > Endpoint Custom Attributes.

  2. Enter the Attribute Name (for example, deviceType) and Data Type (for example, String) in the Endpoint Custom Attributes area.

  3. Click Save.

Step 2

Assign values to the custom attributes.

  1. Choose Context Visibility > Endpoints.

  2. Assign the custom attribute values.

    • Check the required MAC address check box, and then click Edit.

    • Or, click the required MAC address, and then click Edit in the Endpoints page.

  3. Ensure that the custom attribute that you created is displayed in the Custom Attributes area in the Edit Endpoint dialog box.

  4. Click Edit and enter the required attribute value (for example, deviceType = Apple-iPhone).

  5. Click Save.

Step 3

Create a posture policy using the custom attributes and values.

  1. Choose Work Centers > Posture > Posture Policy.

  2. Create the required policy. Choose the custom attributes by clicking Other Conditions and select the required dictionary (for example, choose Endpoints > deviceType, the custom attribute that you created in Step 1). For more information, see the Configure Cisco Temporal Agent Workflow .

  3. Click Save.

To create a client provisioning policy using endpoint custom attributes:

  1. Choose Work Centers > Posture > Client Provisioning > Client Provisioning Policy.

  2. Create the required policy.

    • Create the required rule (for example, Rule Name=WindowsAll, if Identity Groups=Any and Operating Systems=Windows All and Other Conditions=Conditions, then Results=AC_Win_44117).

    • Choose the custom attributes by clicking Other Conditions and selecting the required dictionary.

Custom Posture Remediation Actions

A custom posture remediation action is a file, a link, an antivirus or antispyware definition updates, launching programs, Windows updates, or Windows Server Update Services (WSUS) remediation types.

Add a File Remediation

A file remediation allows clients to download the required file version for compliance. The client agent remediates an endpoint with a file that is required by the client for compliance.

You can filter, view, add, or delete file remediations in the File Remediations window, but you cannot edit file remediations. The File Remediations window displays all the file remediations along with their name and description and the files that are required for remediation.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture .

Step 2

Click Remediation Actions.

Step 3

Click File Remediation.

Step 4

Click Add.

Step 5

Enter the name and description of the file remediation in the Name and Description fields.

Step 6

Modify the values in the New File Remediation window.

Step 7

Click Submit.

Add a Link Remediation

A link remediation allows clients to click a URL to access a remediation window or resource. The client agent opens a browser with the link and allow the clients to remediate themselves for compliance.

The Link Remediation window displays all the link remediations along with their name and description and their modes of remediation.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture.

Step 2

Click Remediation Actions.

Step 3

Click Link Remediation.

Step 4

Click Add.

Step 5

Modify the values in the New Link Remediation window.

Step 6

Click Submit.

Add a Patch Management Remediation

You can create a patch management remediation, which updates clients with up-to-date file definitions for compliance after remediation.

The Patch Management Remediation window displays the remediation type, patch management vendor names, and various remediation options.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture.

Step 2

Click Remediation Actions.

Step 3

Click Patch Mangement Remediation.

Step 4

Click Add.

Step 5

Modify the values in the Patch Management Remediation window.

Step 6

Click Submit to add the remediation action to the Patch Management Remediations window.

Add an Antivirus Remediation

You can create an antivirus remediation, which updates clients with up-to-date file definitions for compliance after remediation.

The AV Remediations window displays all the antivirus remediations along with their name and description and their modes of remediation.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture.

Step 2

Click Remediation Actions.

Step 3

Click AV Remediation.

Step 4

Click Add.

Step 5

Modify the values in the New AV Remediation window.

Step 6

Click Submit.

Add an Antispyware Remediation

You can create an antispyware remediation, which updates clients with up-to-date file definitions for compliance after remediation.

The AS Remediations window displays all the antivirus remediations along with their name and description and their modes of remediation.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture.

Step 2

Click Remediation Actions.

Step 3

Click AS Remediation.

Step 4

Click Add.

Step 5

Modify the values in the New AS Remediations window.

Step 6

Click Submit.

Add a Launch Program Remediation

You can create a launch program remediation, where the client agent remediates clients by launching one or more applications for compliance.

The Launch Program Remediations page displays all the launch program remediations along with their name and description and their modes of remediation.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture.

Step 2

Click Remediation Actions.

Step 3

Click Launch Program Remediation.

Step 4

Click Add.

Step 5

Modify the values in the New Launch Program Remediation page.

Step 6

Click Submit.

Troubleshoot Launch Program Remediation

Problem

When an application is launched as a remediation using Launch Program Remediation, the application is successfully launched (observed in the Windows Task Manager), however, the application UI is not visible.

Solution

The Launch program UI application runs with system privileges, and is visible in the Interactive Service Detection (ISD) window. To view the Launch program UI application, ISD should be enabled for the following OS:

  • Windows Vista: ISD is in stop state by default. Enable ISD by starting ISD service in services.msc.

  • Windows 7: ISD service is enabled by default.

  • Windows 8/8.1: Enable ISD by changing "NoInteractiveServices" from 1 to 0 in the registry: \HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Windows.

Add a Windows Update Remediation

The Windows Update Remediations page displays all the Windows update remediations along with their name and description and their modes of remediation.

Procedure

Step 1

Choose Policy > Policy Elements > Results > > Posture.

Step 2

Click Remediation Actions.

Step 3

Click Windows Update Remediation.

Step 4

Click Add.

Step 5

Modify the values in the New Windows Update Remediation window.

Step 6

Click Submit.

Add a Windows Server Update Services Remediation

You can configure Windows clients to receive the latest WSUS updates from a locally administered or a Microsoft-managed WSUS server for compliance. A Windows Server Update Services (WSUS) remediation installs latest Windows service packs, hotfixes, and patches from a locally managed WSUS server or a Microsoft-managed WSUS server.

You can create a WSUS remediation where the client agent integrates with the local WSUS Agent to check whether the endpoint is up-to-date for WSUS updates.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture.

Step 2

Click Remediation Actions.

Step 3

Click Windows Server Update Services Remediation.

Step 4

Click Add.

Step 5

Modify the values in the New Windows Server Update Services Remediation window.

Step 6

Click Submit.

Posture Assessment Requirements

A posture requirement is a set of compound conditions with an associated remediation action that can be linked with a role and an operating system. All the clients connecting to your network must meet mandatory requirements during posture evaluation to become compliant on the network.

Posture-policy requirements can be set to mandatory, optional, or audit types in posture policies. If requirements are optional and clients fail these requirements, then the clients have an option to continue during posture evaluation of endpoints.

Posture checks are evaluated in the order of mandatory, optional, and audit. If a mandatory check fails, the related audit checks will not be carried out.

Figure 4. Posture Policy Requirement Types

Mandatory Requirements

During policy evaluation, the agent provides remediation options to clients who fail to meet the mandatory requirements defined in the posture policy. End users must remediate to meet the requirements within the time specified in the remediation timer settings.

For example, you have specified a mandatory requirement with a user-defined condition to check the existence of C:\temp\text.file in the absolute path. If the file does not exist, the mandatory requirement fails and the user will be moved to Non-Compliant state.

Optional Requirements

During policy evaluation, the agent provides an option to clients to continue, when they fail to meet the optional requirements specified in the posture policy. End users are allowed to skip the specified optional requirements.

For example, you have specified an optional requirement with a user-defined condition to check for an application running on the client machine, such as Calc.exe. Although, the client fails to meet the condition, the agent prompts an option to continue further so that the optional requirement is skipped and the end user is moved to Compliant state.

Audit Requirements

Audit requirements are specified for internal purposes and the agent does not prompt any message or input from end users, regardless of the pass or fail status during policy evaluation.

For example, you are in the process of creating a mandatory policy condition to check if end users have the latest version of the antivirus program. If you want to find out the non-compliant end users before actually enforcing it as a policy condition, you can specify it as an audit requirement.

Visibility Requirements

During policy evaluation, the agent reports compliance data for visibility requirements, every five to ten minutes.

Client System Stuck in Noncompliant State

If a client machine is unable to remediate a mandatory requirement, the posture status changes to “noncompliant” and the agent session is quarantined. To get the client machine past this “noncompliant” state, you need to restart the posture session so that the agent starts posture assessment on the client machine again. You can restart the posture session as follows:

  • In wired and wireless Change of Authorization (CoA) in an 802.1X environment:

    • You can configure the Reauthentication timer for a specific authorization policy when you create a new authorization profile in the New Authorization Profiles window.

    • Wired users can get out of the quarantine state once they disconnect and reconnect to the network. In a wireless environment, the user must disconnect from the wireless lan controller (WLC) and wait until the user idle timeout period has expired before attempting to reconnect to the network.

  • In a VPN environment—Disconnect and reconnect the VPN tunnel.

Create Client Posture Requirements

You can create a requirement in the Requirements window where you can associate user-defined conditions and Cisco defined conditions, and remediation actions. Once created and saved in the Requirements window, user-defined conditions and remediation actions can be viewed from their respective list windows.


Note
To create a Posture Requirement to validate all Windows 10 hotfixes in the environment, you must configure the Conditions area of your Requirement to include both pr_Win10_32_Hotfixes and pr_Win10_64_Hotfixes via AND '&' statement. To view the details of the validated conditions for an endpoint, from the main menu, choose Operations > Reports > Reports > Endpoints and Users > Posture Assessment by Endpoints. Click the endpoint to view the corresponding posture details.

Before you begin

  • You must have an understanding of acceptable use policies (AUPs) for a posture.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture > Requirements.

Step 2

Enter the values in the Requirements window.

Step 3

Click Done to save the posture requirement in read-only mode.

Step 4

Click Save.

Custom Permissions for Posture

A custom permission is a standard authorization profile that you define in Cisco ISE. Standard authorization profiles set access privileges based on the matching compliance status of the endpoints. The posture service broadly classifies the posture into unknown, compliant, and noncompliant profiles. The posture policies and the posture requirements determine the compliance status of the endpoint.

You must create three different authorization profiles for an unknown, compliant, and noncompliant posture status of endpoints that can have different set of VLANs, DACLs, and other attribute value pairs. These profiles can be associated with three different authorization policies. To differentiate these authorization policies, you can use the Session:PostureStatus attribute along with other conditions.

Unknown Profile

If no matching posture policy is defined for an endpoint, then the posture compliance status of the endpoint may be set to unknown. A posture compliance status of unknown can also apply to an endpoint where a matching posture policy is enabled but posture assessment has not yet occurred for that endpoint and, therefore no compliance report has been provided by the client agent.


Note

We recommend you to use posture with redirection for all Cisco network access devices.

Compliant Profile

If a matching posture policy is defined for an endpoint, then the posture compliance status of the endpoint is set to compliant. When the posture assessment occurs, the endpoint meets all the mandatory requirements that are defined in the matching posture policy. For an endpoint that is postured compliant, it can be granted privileged network access on your network.

Noncompliant Profile

The posture compliance status of an endpoint is set to noncompliant when a matching posture policy is defined for that endpoint but it fails to meet all the mandatory requirements during posture assessment. An endpoint that is postured noncompliant matches a posture requirement with a remediation action, and it should be granted limited network access to remediation resources in order to remediate itself.

Configure Standard Authorization Policies

You can define two types of authorization policies on the Authorization Policy window, standard exceptions authorization policies. The standard authorization policies that are specific to posture are used to make policy decisions based on the compliance status of endpoints.

Procedure

Step 1

Choose Policy > Policy Sets.

Step 2

In the View column, click the arrow icon adjacent the corresponding Default Policy.

Step 3

In the Actions column, click the cog icon, and then from the dropdown list, choose a new authorization policy.

A new row appears in the Policy Sets table.
Step 4

Enter a rule name.

Step 5

From the Conditions column, click the (+) symbol.

Step 6

Create the required conditions on the Conditions Studio Page. In the Editor section, click the Click To Add an Attribute text box, and select the required Dictionary and Attribute.

You can drag and drop a Library condition to the Click To Add An Attribute text box.

Step 7

Click Use to create a new standard authorization policy in read-only mode.

Step 8

Click Save.

Best Practices for Network Drive Mapping with Posture

During posture assessment of a Windows endpoint, the endpoint user may encounter a delay in accessing the desktop. This may be due to Windows trying to restore the file server drive letter mappings before providing the user access to the desktop. The best practices to avoid the delay during posture are:

  • Endpoints should be able to reach the Active Directory server because the file server drive letter cannot be mapped without reaching the AD. When posture (with AnyConnect ISE posture agent) triggers, it blocks access to AD, causing delay in login. Use Posture Remediation ACLs to provide access to AD servers before posture is completed.

  • You should set a delay for the login script until posture completes and then you have to set the Persistence attribute to NO. Windows tries to reconnect all the network drives during login and this cannot be done until AnyConnect ISE posture agent gains full network access.

Configure AnyConnect Stealth Mode Workflow

The process of configuring AnyConnect in the stealth mode involves a series of steps. You should perform the following steps in Cisco ISE.

Procedure

Step 1

Create an AnyConnect agent profile, see Create an AnyConnect agent profile.

Step 2

Create an AnyConnect configuration for AnyConnect packages, see Create the AnyConnect configuration.

Step 3

Upload a Open DNS Profile in Cisco ISE, see Upload a Open DNS profile in Cisco ISE.

Step 4

Create a Client Provisioning Policy, see Create a client provisioning policy.

Step 5

Create a Posture Condition, see Create the posture condition.

Step 6

Create Posture Remediation, see Create the posture remediation.

Step 7

Create Posture Requirement in Clientless Mode, see Create the posture requirement in Clientless mode.

Step 8

Create Posture Policy, see Create the posture policy.

Step 9

Configure authorization profile.

  1. Choose Policy > Policy Elements > Results > Authorization > Authorization Profiles.

  2. Click Add and enter the Name of the profile.

  3. In Common Tasks, enable Web Redirection (CWA, MDM, NSP, CPP) and choose Client provisioning (Posture) from the drop-down list, enter the redirect ACL name and choose the Client Provisioning Portal Value. You can edit or create a new Client Provisioning Portal in Work Centers > Posture > Client Provisioning > Client Provisioning Portal.

Step 10

Configure authorization policies.

  1. Choose Policy > Policy Sets.

  2. Click > and choose Authorization Policy and click on + icon to create a new authorization rule that features Session:Posture Status EQUALS Unknown condition and the authorization profiled configured previously.

  3. Above the previous rule, create a new authorization rule that features Session:Posture Status EQUALS NonCompliant condition and another one that features Session:Posture Status EQUALS Compliant condition.

Create an AnyConnect Agent Profile

Before you begin

You must upload the AnyConnect packages for MAC and Windows OS and the AnyConnect compliance modules.

Procedure

Step 1

Choose Policy > Policy Elements > Results > Client Provisioning > Resources page.

Step 2

From the Add drop-down list, choose Nac Agent or AnyConnect Posture Profile.

Step 3

From the Posture Agent Profile Settings drop-down list, choose AnyConnect.

Step 4

In the Name field, type the required name (for example, AC_Agent_Profile).

Step 5

In the Agent Behavior section, select the Stealth Mode parameter as Enabled .

Step 6

Click Save.

What to do next

You should create the AnyConnect configuration for the AnyConnect packages.

Create an AnyConnect Configuration for AnyConnect Packages

Procedure

Step 1

Choose Policy > Policy Elements > Results > Client Provisioning > Resources page.

Step 2

From the Add drop-down list, choose AnyConnect Configuration.

Step 3

From the Select AnyConnect Package drop-down list, choose the required AnyConnect package.

Step 4

In the Configuration Name text box, type the required Name.

Step 5

In the Compliance Module drop-down list, choose the required compliance module.

Step 6

In the AnyConnect Module Selection section, check the ISE Posture and Network Access Manager check boxes.

Step 7

In the Profile Selection section, from the ISE Posture drop-down list, choose the AnyConnect agent profile.

Step 8

From the Network Access Manager drop-down list, choose the required AnyConnect agent profile.

What to do next

You should upload the Open DNS profile to be pushed to the client.

Upload a Open DNS Profile in Cisco ISE

The Open DNS profile is pushed to the client.

Procedure

Step 1

Navigate to the Policy > Policy Elements > Results > Client Provisioning > Resources page.

Step 2

From the Add drop-down list, choose Agent Resources From Local Disk.

Step 3

From the Category drop-down list, choose Customer Created Packages.

Step 4

From the Type drop-down list, choose AnyConnect Profile .

Step 5

In the Name text box, type the required name (for example, OpenDNS).

Step 6

Click Browse and locate the JSON file from the local disk.

Step 7

Click Submit.

What to do next

You should create the client provisioning policy.

Create a Client Provisioning Policy

Procedure

Step 1

Navigate to the Policy > Client Provisioning page.

Step 2

Create the required rule (for example, Rule Name=WindowsAll, if Identity Groups=Any and Operating Systems=Windows All and Other Conditions=Conditions, then Results=AC_Win_44117).

What to do next

You should create the posture condition.

Create a Posture Condition

Procedure

Step 1

Navigate to the Policy > Policy Elements > Conditions > Posture > File Condition.

Step 2

Enter the required name (for example, filechk).

Step 3

From the Operating Systems drop-down list, choose Windows 7 (All).

Step 4

From the File Type drop-down list, choose FileExistence.

Step 5

From the File Path drop-down list, choose ABSOLUTE_PATH C:\test.txt.

Step 6

From the File Operator drop-down list, choose DoesNotExist.

What to do next

You should create the posture remediation.

Create Posture Remediation

The file condition checks if test.txt file exists on the endpoint. If it does not exist, the remediation is to block the USB port and prevent the installation of the file using a USB device.

Procedure

Step 1

Navigate to the Policy > Policy Elements > Results > Remediation Actions > USB Remediations page.

Step 2

Enter the required name (for example, clientless_mode_block).

Step 3

Click Submit.

What to do next

You should create the posture requirement.

Create Posture Requirement in Stealth Mode

When you create a Remediation action from the Requirements page, only the remediations that are applicable to stealth mode are displayed: Anti-Malware, Launch Program, Patch Management, USB, Windows Server Update Services, and Windows Update.

Procedure

Step 1

Navigate to the Policy > Policy Elements > Results > Client Provisioning > Resources page.

Step 2

Create the required posture requirement (for example, Name=win7Req for Operating Systems=Windows7(All) using Compliance Module=4.x or later using Posture Type=AnyConnect Stealth met if Condition=filechk then Remediation Actions=clientless_mode_block).

What to do next

You should create the posture policy.

Create Posture Policy

Before you begin

Ensure that the posture policy requirement and the policy are created in the clientless mode.

Procedure

Step 1

Choose Policy > Posture.

Step 2

Create the required rule. For example, if Identity Groups=Any and Operating Systems=Windows 7(All) and Compliance Module=4.x or later and Posture Type=AnyConnect Stealth then Requirements=win7Req.

Note 

For Client Provisioning without URL redirection, configuring the conditions with attributes specific to Network Access or Radius will not work and matching of the client provisioning policy might fail due to the non-availability of session information for the specific user in the Cisco ISE server. However, Cisco ISE allows configuring conditions for the externally added identity groups.

Posture Types

The following posture agents monitor and enforce Cisco ISE posture policies:

  • AnyConnect: Deploys the AnyConnect agent to monitor and enforce Cisco ISE posture policies that require interaction with the client. The AnyConnect agent stays on the client. For more information about using AnyConnect in Cisco ISE, see Cisco AnyConnect Secure Mobility.

  • AnyConnect Stealth: Runs posture as a service, with no user interface. The agent stays on the client.

    When you choose the AnyConnect Stealth posture type in the posture requirement, some of the conditions, remediations, or attributes in a condition are disabled (grayed out). For example, when you enable AnyConnect Stealth requirement, the Manual Remediation Type is disabled (grayed out) because this action requires client-side interaction.

    When you map the posture profile to the AnyConnect configuration, and then map the AnyConnect configuration to the Client Provisioning window for AnyConnect Stealth mode deployment:

    • AnyConnect can read the posture profile and set it to the intended mode.

    • AnyConnect can send information related to the selected mode to Cisco ISE during the initial posture request.

    • Cisco ISE can match the right policy, based on the mode and other factors, such as identity group, OS, and compliance module.


    Note
    AnyConnect Stealth mode requires AnyConnect version 4.4 and later.

    For more information about configuring AnyConnect Stealth in Cisco ISE, see Configure AnyConnect Stealth Mode Workflow.

  • Temporal Agent: When a client attempts to access the trusted network, Cisco ISE opens the Client Provisioning portal. The portal instructs the user to download and install the agent, and run the agent. The temporal agent checks the compliance status, and sends the status to Cisco ISE. Cisco ISE acts based on the results. The temporal agent removes itself from the client after compliance processing completes. The temporal agent does not support custom remediation. The default remediation supports only message text.

    The Temporal Agent does not support the following conditions:

    • Service Condition MAC—System Daemon check

    • Service Condition-MAC—Daemon or User Agent check

    • PM—Up To Date check

    • PM—Enabled check

    • DE—Encryption check

    • Configure posture policies using the Posture Types Temporal Agent and Compliance Module 4.x or later. Do not configure the compliance module as 3.x or earlier or Any Version.

    • For the Temporal Agent, you can only view Patch Management conditions containing the Installation check type in the Requirements window.

    • Cisco ISE does not support VLAN-controlled posture with the Temporal Agent for Mac OSX. When you change the network access from an existing VLAN to a new VLAN, the user’s IP address is released before the VLAN change. The client gets a new IP address by DHCP when the user connects to the new VLAN. Recognizing the new IP address requires root privileges, but the Temporal Agent runs as a user process.

    • Cisco ISE supports ACL-controlled posture environment, which does not require the refreshing of endpoint IP addresses.

    • For more information about configuring the Temporal agent in Cisco ISE, see Configure Cisco Temporal Agent Workflow.

You can select the posture type in the Client Provisioning window (Policy > Policy Elements > Results > Client Provisioning > Resources) and the Posture Requirements window (Policy > Policy Elements > Results > Posture > Requirements). The best practice is to provision the posture profile in the Client Provisioning window.

Configure Cisco Temporal Agent Workflow

The process of configuring the Cisco temporal agent involves a series of steps. You should perform the following steps in Cisco ISE.

Procedure

Step 1

Create the posture condition.

Step 2

Create posture requirements.
Step 3

Create the posture policy.
Step 4

Configure the client provisioning policy.
Step 5

Configure authorization profile.

  1. Choose Policy > Policy Elements > Results > Authorization > Authorization Profiles.

  2. Click Add and enter the Name of the profile.

  3. In Common Tasks, enable Web Redirection (CWA, MDM, NSP, CPP) and choose Client provisioning (Posture) from the drop-down list, enter the redirect ACL name and choose the Client Provisioning Portal Value. You can edit or create a new Client Provisioning Portal in Work Centers > Posture > Client Provisioning > Client Provisioning Portal.

Step 6

Configure authorization policies.

  1. Choose Policy > Policy Sets.

  2. Click > and choose Authorization Policy and click on + icon to create a new authorization rule that features Session:Posture Status EQUALS Unknown condition and the authorization profiled configured previously.

  3. Above the previous rule, create a new authorization rule that features Session:Posture Status EQUALS NonCompliant condition and another one that features Session:Posture Status EQUALS Compliant condition.

Step 7

Operations performed by the client.

Create Posture Condition

Procedure

Step 1

Navigate to the Policy > Policy Elements > Conditions > Posture > File Condition.

Step 2

Enter the required name (for example, filecondwin).

Step 3

From the Operating Systems drop-down list, choose Windows 7 (All).

Step 4

From the File Type drop-down list, choose FileExistence.

Step 5

From the File Path drop-down list, choose ABSOLUTE_PATH C:\test.txt.

Step 6

From the File Operator drop-down list, choose DoesNotExist.

Create Posture Requirements

Procedure

Step 1

Choose Policy > Policy Elements > Results > Posture > Requirements
Step 2

From the Edit drop-down list, choose Insert New Requirement.

Step 3

Enter the Name, Operating Systems, and Compliance Module (for example, Name filereqwin, Operating Systems Windows All, Compliance Module 4.x or later).

Step 4

In the Posture Type drop-down, choose Temporal Agent.

Step 5

Select the required condition (for example, filecondwin).

Note 

For the Cisco Termporal Agent, you can only view Patch Management conditions containing the Installation check type in the Requirements page.

Step 6

Select the Message Text Only remediation action.

Note 
The temporal agent is supported by AnyConnect 4.x or later.

Create the Posture Policy

Procedure

Step 1

Choose Policy > Posture.

Step 2

Create the required rule (for example, Name=filepolicywin, Identity Groups=Any, Operating Systems=Windows All, Compliance Module=4.x or later, Posture Type=Temporal Agent, and Requirements=filereqwin).

Configure the Client Provisioning Policy

Procedure

Step 1

Choose Policy > Client Provisioning.

Step 2

Create the required rule (for example, Rule Name=Win, Identity Groups=Any, Operating Systems=Windows All, Other Conditions=Conditions, Results=CiscoTemporalAgentWindows4.5).

Download and Launch Cisco Temporal Agent

Procedure

Step 1

Connect to the SSID.
Step 2

Launch a Browser and you will be redirected to the Client Provisioning Portal.
Step 3

Click Start. This checks if the Cisco Temporal agent is installed and running.

Step 4

Click This Is My First Time Here.

Step 5

Choose Click Here to Download and Launch Cisco Temporal Agent.

Step 6

Save the Cisco Temporal Agent .exe or .dmg file for Windows or Mac OSX respectively. For Windows, run the .exe file and for Mac OSX, double-click the .dmg file and run the acisetempagent app.

The Cisco Temporal Agent scans the client and displays the results, such as Red cross marks for non-compliant checks.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco