La documentazione per questo prodotto è stata redatta cercando di utilizzare un linguaggio senza pregiudizi. Ai fini di questa documentazione, per linguaggio senza di pregiudizi si intende un linguaggio che non implica discriminazioni basate su età, disabilità, genere, identità razziale, identità etnica, orientamento sessuale, status socioeconomico e intersezionalità. Le eventuali eccezioni possono dipendere dal linguaggio codificato nelle interfacce utente del software del prodotto, dal linguaggio utilizzato nella documentazione RFP o dal linguaggio utilizzato in prodotti di terze parti a cui si fa riferimento. Scopri di più sul modo in cui Cisco utilizza il linguaggio inclusivo.
Cisco ha tradotto questo documento utilizzando una combinazione di tecnologie automatiche e umane per offrire ai nostri utenti in tutto il mondo contenuti di supporto nella propria lingua. Si noti che anche la migliore traduzione automatica non sarà mai accurata come quella fornita da un traduttore professionista. Cisco Systems, Inc. non si assume alcuna responsabilità per l’accuratezza di queste traduzioni e consiglia di consultare sempre il documento originale in inglese (disponibile al link fornito).
In questo documento viene descritto come configurare Application Visibility on Identity Service Engine (ISE) 2.2 e risolvere i relativi problemi. Visibilità applicazione consente di monitorare le applicazioni installate sugli endpoint, creare criteri basati su tali informazioni e terminare o disinstallare le applicazioni durante i controlli di postura se soddisfano le condizioni specificate. AnyConnect invia periodicamente informazioni ad ISE con un elenco delle applicazioni e dei processi installati/in esecuzione. AnyConnect può raccogliere informazioni su tutte le applicazioni o sulle applicazioni da categorie specifiche (browser, crittografia, ecc.).
Cisco raccomanda la conoscenza di base dei seguenti argomenti:
Cisco Identity Service Engine
Le informazioni fornite in questo documento si basano sulle seguenti versioni software e hardware:
1. Selezionare Policy > Policy Elements > Results > Client Provisioning > Results on ISE (Criteri > Elementi criteri > Risultati > Provisioning client > Risultati su ISE). Fare clic su Aggiungi > Risorse agente dal disco locale:
2. Selezionare Category come Cisco Provided Packages e Choose File (AnyConnect package):
Fare clic su Invia per salvare le modifiche.
Dovrebbe essere richiesto di confermare i checksum del pacchetto caricato. Confrontarli con i checksum forniti su un sito Web Cisco per verificare che il pacchetto non sia danneggiato.
Nella pagina Risultati del provisioning client, fare clic su Aggiungi > Risorse agente dal sito Cisco in modo da visualizzare una finestra con i moduli disponibili. Selezionare il modulo di conformità AnyConnect richiesto per Windows e fare clic su Salva.
Oppure, se non disponi di una connessione Internet sull'ISE, puoi scaricare l'ultimo modulo di conformità dal sito cisco.com e caricarlo sull'ISE come nel pacchetto AnyConnect.
Se nella rete è presente un proxy, configurarlo nella pagina Amministrazione > Sistema > Impostazioni > Proxy.
Nella scheda Pagina Risultati di Client Provisioning, fare clic su Add > NAC Agent o AnyConnect Posture Profile e selezionare AnyConnect da Posture Agent Profile Settings:
Denominare il profilo e compilare i campi obbligatori. Fare clic su Invia per salvare il profilo.
Nella pagina Risultati del provisioning client, fare clic su Add > AnyConnect Configuration e selezionare il pacchetto caricato nel passaggio 1:
È necessario caricare opzioni aggiuntive. Compilare tutti i campi obbligatori e fare clic su Invia per salvare le modifiche:
Nome configurazione - nome della configurazione. Viene utilizzato nei criteri di provisioning client (passaggio successivo).
Modulo di conformità: selezionare il modulo di conformità scaricato nella Fase 2.
ISE Posture: selezionare AnyConnect Posture Profile, creato nel passaggio 3.
Selezionare Policy > Client Provisioning. Per creare un nuovo criterio o modificarne uno esistente per Windows, selezionare la configurazione AnyConnect creata come segue:
Passare a Criterio > Elementi criteri > Risultati > Autorizzazione > Profili di autorizzazione e fare clic su Aggiungi per creare un nuovo profilo. Configurarlo per il reindirizzamento al portale di provisioning client:
Fare clic su Invia per salvare il profilo.
Tenere presente che per il corretto reindirizzamento, è necessario creare un acl di reindirizzamento (nell'esempio, ISE-REDIRECT) sull'unità NAD (Network Access Device). L'ACL di reindirizzamento di base non deve intercettare il traffico da e verso i nodi ISE PSN, DNS e DHCP. E deve reindirizzare il traffico HTTP e HTTPS. Alcuni ACL di esempio sono disponibili nei seguenti documenti: Autenticazione Web centrale sul WLC e ISE Configuration Example e Autenticazione Web centrale con uno switch e Identity Services Engine Configuration Example
Passare a Criterio > Autorizzazione, creare 2 criteri con controllo dello stato della postura:
Con questa configurazione, se un endpoint non ha AnyConnect installato o non ha ancora completato la postura, viene reindirizzato al portale di provisioning client. L'utente finale può installare AnyConnect da ISE e AnyConnect può rilevare ISE e controllare la postura.
Fare clic su Save (Salva).
Passate a Amministrazione > Impostazioni > Postura > Aggiornamenti e fate clic su Aggiorna ora per aggiornare la postura. Contiene i grafici e le definizioni OPSWAT per le applicazioni ed è necessario per la creazione delle policy.
In alternativa, se non si dispone di una connessione Internet, è possibile scaricare gli ultimi aggiornamenti della postura da https://www.cisco.com/web/secure/pmbu/posture-offline.html, quindi selezionare Amministrazione > Sistema > Impostazioni > Postura > Aggiornamenti, selezionare Non in linea e selezionare il file scaricato con gli aggiornamenti della postura. Fare clic su Aggiorna ora per caricare il file e installare gli aggiornamenti della postura.
AnyConnect raccoglie informazioni sulle applicazioni installate solo con il modulo di conformità 4.x (o versioni successive).
Con la versione 3.x di Compliance Module, è possibile eseguire solo controlli di processo (AnyConnect significa che controlla se il processo specificato è in esecuzione o meno).
Con Application State è possibile configurare le seguenti combinazioni:
Con Provision by possono essere selezionati: Tutto, Nome e Categoria:
Per raccogliere informazioni sulle applicazioni installate e in esecuzione in Criteri > Elementi criterio > Condizioni > Postura > Condizione applicazione, fare clic su Aggiungi per creare una nuova condizione e compilare i campi obbligatori come mostrato:
In Criteri > Elementi criterio > Risultati > Postura > Requisiti creare un nuovo requisito con la Condizione applicazione creata:
Per consentire ad ISE e AnyConnect di raccogliere informazioni sulle applicazioni, i criteri di postura devono includere un requisito con una condizione dell'applicazione. Il criterio di postura può essere creato in Criterio > Postura. Se si desidera raccogliere informazioni per un utilizzo successivo, è possibile impostare il requisito come Controllo.
ISE consente di configurare la frequenza con cui AnyConnect deve inviare ad ISE gli aggiornamenti sulle applicazioni. Per impostazione predefinita, l'intervallo è impostato su 5 minuti e può essere modificato in Amministrazione > Impostazioni > Postura > Impostazioni generali:
Dopo la raccolta dei dati dall'endpoint, è possibile creare la conformità dell'applicazione in Context Visibility > Endpoints > [ENDPOINT]:
Fare riferimento a questa sezione per verificare che la configurazione funzioni correttamente.
In RADIUS LiveLogs il flusso sembra un normale flusso di postura: Autenticazione + Reindirizzamento al portale di provisioning > Modifica di autorizzazione (CoA) > Corrispondenza dei criteri di postura conformi.
Dopo la configurazione del provisioning del client (se prima non era stato eseguito il provisioning di AnyConnect) e dell'intervallo di monitoraggio continuo, è possibile verificare il processo di raccolta dei dati in Context Visibility > Endpoints. Fare clic sull'indirizzo MAC dell'endpoint. Verrà aperta la pagina dell'endpoint. Contiene informazioni sulle applicazioni installate sull'endpoint stesso:
A causa di CSCve82743, sarà necessario accedere all'endpoint due volte e premere Aggiorna per visualizzare la tabella delle applicazioni.
Tali elementi devono essere creati con l'opzione Crea conformità applicazione:
e possono essere verificati dall'interfaccia grafica di ISE. Le condizioni si trovano in Criterio > Elementi criteri > Condizioni > Postura > Condizione applicazione:
Le correzioni si trovano in Criteri > Elementi criteri > Risultati > Postura > Azioni di correzione > Correzioni applicazione:
I requisiti si trovano in Policy > Elementi della politica > Risultati > Postura > Requisiti:
I criteri si trovano in Criteri > Postura:
Ogni report di postura di ciascun endpoint viene memorizzato su ISE e può essere controllato da Operazioni > Report. Esistono due varianti di rapporti Postura:
La valutazione della postura per condizione ha l'aspetto illustrato. In questo esempio una delle condizioni obbligatorie non viene soddisfatta e lo stato della postura viene impostato su non conforme:
Valutazione postura per endpoint:
I dettagli di ogni controllo di postura possono essere controllati facendo clic sull'icona Dettagli rapporto -
Le informazioni contenute in questa sezione permettono di risolvere i problemi relativi alla configurazione.
ise-psc.log contiene tutte le informazioni relative alla postura, inclusi i debug. I debug di postura possono essere abilitati selezionando Amministrazione > Sistema > Registrazione > Configurazione log di debug. Il nome del componente è postura:
Quando un endpoint è collegato alla rete e AnyConnect raggiunge l'ISE, ISE controlla se EP deve essere confrontato con i controlli di postura configurati e rileva la versione del modulo di conformità installato sull'ISE. In base alle informazioni raccolte, ISE genera una query di postura per l'xml dell'agente EP - NAC e la cripta. In seguito, ISE invia la richiesta ad AnyConnect.
2017-01-04 19:19:13,686 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- About to query posture policy for user cisco with endpoint mac C0-4A-00-15-75-C8 2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureManager -:cisco:::- agentCMVersion=4.2.468.0, agentType=AnyConnect Posture Agent, groupName=OESIS_V4_Agents -> found agent group with displayName=4.x or later 2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- User cisco belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any 2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- About to retrieve posture policy resources for os 7 Enterprise, agent group 4.x or later and identity groups [NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation, NAC Group:NAC:IdentityGroups:Any] 2017-01-04 19:19:13,687 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by agent group with FQN NAC Group:NAC:AgentGroupRoot:ALL:OESIS_V4_Agents 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- The evaluation result by agent group for resourceId NAC Group:NAC:Posture:PosturePolicies:Apps is Permit 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by OS group with FQN NAC Group:NAC:OsGroupRoot:ALL:WINDOWS_ALL:WINDOWS_7_ALL:WINDOWS_7_ENTERPRISE_ALL 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- stealth mode is 0 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- The evaluation result by os group for resourceId NAC Group:NAC:Posture:PosturePolicies:Apps is Permit 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Evaluate resourceId NAC Group:NAC:Posture:PosturePolicies:Apps by Stealth mode NSF group with FQN NAC Group:NAC:StealthModeStandard 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Procesing obligation with posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Found obligation id urn:cisco:cepm:3.3:xacml:response-qualifier for posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Found obligation id PostureReqs for posture policy resource with id NAC Group:NAC:Posture:PosturePolicies:Apps 2017-01-04 19:19:13,688 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- Posture policy resource id Apps has following associated requirements [] 2017-01-04 19:19:13,720 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- policy enforcemnt is 2 2017-01-04 19:19:13,720 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- simple condition: [Name=Apps_Collection, Description=null, Application State =installed,runnning, Provision By =Everything, monitory Categories = []] 2017-01-04 19:19:13,720 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cpm.posture.runtime.agent.AgentXmlGenerator -:cisco:::- check type is ApplicationVisibility 2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- NAC agent xml <?xml version="1.0" encoding="UTF-8"?><cleanmachines> <version>ISE: 2.2.0.423</version> <encryption>0</encryption> <package> <id>12</id> <name>Apps_collection</name> <description>Apps Check</description> <version/> <type>3</type> <optional>2</optional> <action>3</action> <check> <id>Apps_Collection</id> <category>12</category> <type>1202</type> <monitor>ALL</monitor> <evaluation>periodic</evaluation> </check> <criteria>(Apps_Collection)</criteria> </package> </cleanmachines> 2017-01-04 19:19:13,800 INFO [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil - getPosturePolicyHTML [<cleanmachines><version>ISE: 2.2.0.423</version><encryption>0</encryption><package><id>12</id><name>Apps_collection</name><description>Apps Check</description><version/><type>3</type><optional>2</optional><action>3</action><check><id>Apps_Collection</id><category>12</category><type>1202</type><monitor>ALL</monitor><evaluation>periodic</evaluation></check><criteria>(Apps_Collection)</criteria></package></cleanmachines>] 2017-01-04 19:19:13,800 INFO [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil -getPosturePolicyHTML - do encrypt 2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- Encrypting policy using AES key. 2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.CipherUtil -:cisco:::- Encrypting message using AES. 2017-01-04 19:19:13,800 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- IV Base 64: AeUQGbj6CP/jMB+cTIGIGQ== 2017-01-04 19:19:13,801 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.util.StatusUtil -:cisco:::- StatusUtil.getPosturePolicyHTML() returns <!--X-Perfigo-UserKey=--><!--X-Perfigo-Provider=Device Filter--><!--X-Perfigo-UserName=cisco--><!--error=1010--><!--X-Perfigo-DM-Error=1010--><!--user role=--><!--X-Perfigo-OrigRole=--><!--X-Perfigo-DM-Scan-Req=0--><!--X-ISE-IV=AeUQGbj6CP/jMB+cTIGIGQ==--><!--X-Perfigo-DM-Software-List=f5aGq8rU5wx7hFS9WnugNhy/6HaSxNtKesoqAjYkecEk56t+I/J93PtAYU0XLq451NXQhReuFktImYEPEnWwOs1bV5oOTuTsY3kEbcuR4p5Sp0cfz/j98YEubNtSKDCUGt5U8dhpOJqMYTV4UcaSP/D0FXYm10gFEjPxpPghyWcplzYwcpehIX+2vOYOSzPTEvM2kDdHTkof+/UYvBfGv8Y7YkK9P61upfSedIqdynyxUbeqknXkoCaWvUawJLVWiXAJs2atsCwJjXitwNHYzCuH/mBz/Y9AUvbLCB/cutCeyVCl7ij8wtXUAt2NpKqeEj0COOxnp5B35JTBfOSXHfVjL29E5JALaun6RR8yJlkd4apk7qflnjsu451CHY/SbKTMnqjV5bNwXfuCBf++X6X/mh0nwk+r2iWhJJFyqmNxBm2BvcJAJXOKOV7xHIhgmLj+etF4Sss/zwnFT4+WTzKI+BpbrVdnZjUP7+uvbQbIPtRFqJVI5StjZlIP4vLzFWKbWXI+itTX6hjqvNhiT2zwktvIboUZXaBV6yS5/+5cYMU3+EhWxIx/UVo0o7sX--><!--X-Perfigo-DM-Session-Time=240--> 2017-01-04 19:19:13,801 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PosturePolicyUtil -:cisco:::- User cisco belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any 2017-01-04 19:19:13,801 DEBUG [http-bio-10.48.26.60-8443-exec-9][] cisco.cpm.posture.runtime.PostureHandlerImpl -:cisco:::- Sending response to endpoint C0-4A-00-15-75-C8 http response [[ <!--X-Perfigo-UserKey=--><!--X-Perfigo-Provider=Device Filter--><!--X-Perfigo-UserName=cisco--><!--error=1010--><!--X-Perfigo-DM-Error=1010--><!--user role=--><!--X-Perfigo-OrigRole=--><!--X-Perfigo-DM-Scan-Req=0--><!--X-ISE-IV=AeUQGbj6CP/jMB+cTIGIGQ==--><!--X-Perfigo-DM-Software-List=f5aGq8rU5wx7hFS9WnugNhy/6HaSxNtKesoqAjYkecEk56t+I/J93PtAYU0XLq451NXQhReuFktImYEPEnWwOs1bV5oOTuTsY3kEbcuR4p5Sp0cfz/j98YEubNtSKDCUGt5U8dhpOJqMYTV4UcaSP/D0FXYm10gFEjPxpPghyWcplzYwcpehIX+2vOYOSzPTEvM2kDdHTkof+/UYvBfGv8Y7YkK9P61upfSedIqdynyxUbeqknXkoCaWvUawJLVWiXAJs2atsCwJjXitwNHYzCuH/mBz/Y9AUvbLCB/cutCeyVCl7ij8wtXUAt2NpKqeEj0COOxnp5B35JTBfOSXHfVjL29E5JALaun6RR8yJlkd4apk7qflnjsu451CHY/SbKTMnqjV5bNwXfuCBf++X6X/mh0nwk+r2iWhJJFyqmNxBm2BvcJAJXOKOV7xHIhgmLj+etF4Sss/zwnFT4+WTzKI+BpbrVdnZjUP7+uvbQbIPtRFqJVI5StjZlIP4vLzFWKbWXI+itTX6hjqvNhiT2zwktvIboUZXaBV6yS5/+5cYMU3+EhWxIx/UVo0o7sX--><!--X-Perfigo-DM-Session-Time=240--> ]] 2017-01-04 19:19:13,959 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- receiving request from client C0:4A:00:15:75:C8 10.62.148.162 bcu5ksw0 2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found the ipAddress that matched the http request remote address 10.62.148.162 and corresponding client mac address C0-4A-00-15-75-C8 2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- looking for Radius session with input values : sessionId: 0a3e946500000066586d3c42, MacAddr: C0-4A-00-15-75-C8, ipAddr: 10.62.148.162 2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- looking for session using session ID: 0a3e946500000066586d3c42, IP addrs: [10.62.148.162], mac Addrs [C0-4A-00-15-75-C8] 2017-01-04 19:19:13,966 DEBUG [http-bio-10.48.26.60-8443-exec-5][] cisco.cpm.posture.runtime.PostureRuntimeFactory -::::- Found session using sessionId 0a3e946500000066586d3c42
Il report completo su AnyConnect. Questo report contiene informazioni su tutte le applicazioni trovate che soddisfano la condizione dell'applicazione configurata.
2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- UDID is 766bb955e51e4ab063fd478c63acee81260ca592 for end point C0-4A-00-15-75-C8 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- os version from user agent is 1.2.1.6.1.4 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Received posture request [parameters: reqtype=, userip=10.62.148.162, clientmac=C0-4A-00-15-75-C8, os=, osVerison=1.2.1.6.1.4, architecture=, provider=, state=, userAgent=Mozilla/4.0 (compatible; WINDOWS; 1.2.1.6.1.4; AnyConnect Posture Agent v.4.4.00209), session_id= 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found a session info for endpoint C0-4A-00-15-75-C8 cisco 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Got userid cisco from cache for endpoint C0-4A-00-15-75-C8/ 2017-01-04 19:19:37,358 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Report IV in Base64: JjneGgZcJbmjqMKQcy8kJg== 2017-01-04 19:19:37,359 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Using AES shared secret to decrypt report. 2017-01-04 19:19:37,359 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.util.CipherUtil -::::- Decrypting message using AES. 2017-01-04 19:19:37,359 DEBUG [http-bio-10.48.26.60-8443-exec-3][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Decrypted report [[ <report><version>1000</version><package><id>12</id><status>1</status><check><chk_id>Apps_Collection</chk_id><diff>0</diff><application><diff>0</diff><id></id><name>Adobe Flash Player 23 NPAPI</name><vendor>Adobe Systems Incorporated</vendor><version>23.0.0.207</version><category>Unclassified</category></application><application><diff>0</diff><id>104</id><name>Adobe Flash Player</name><vendor>Adobe Systems Inc.</vendor><version>23.0.0.207</version><path>C:\Windows\SysWOW64\Macromed\Flash\</path><category>Unclassified</category></application><application><diff>0</diff><id>873</id><name>BitLocker Drive Encryption</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>DiskEncryption</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Diagnostics and Reporting Tool</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\DART\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect ISE Compliance Module</name><vendor>Cisco Systems, Inc</vendor><version>4.2.468.0</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\opswat\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect ISE Posture Module</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path><category>Unclassified</category><process><diff>0</diff><pid>704</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path><hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash></process><process><diff>0</diff><pid>1296</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path><hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash></process><process><diff>0</diff><pid>3076</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path><hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash></process><process><diff>0</diff><pid>3384</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path><hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash></process><process><diff>0</diff><pid>15924</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path><hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash></process></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Profile Editor</name><vendor>Cisco Systems, Inc.</vendor><version>4.1.08005</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Profile Editor\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Secure Mobility Client </name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Cisco AnyConnect Secure Mobility Client</name><vendor>Cisco Systems, Inc.</vendor><version>4.4.00209</version><path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path><category>Unclassified</category><process><diff>0</diff><pid>704</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path><hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash></process><process><diff>0</diff><pid>1296</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path><hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash></process><process><diff>0</diff><pid>3076</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path><hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash></process><process><diff>0</diff><pid>3384</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path><hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash></process><process><diff>0</diff><pid>15924</pid><path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path><hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash></process></application><application><diff>0</diff><id></id><name>Cisco NAC Agent </name><vendor>Cisco Systems, Inc.</vendor><version>4.9.5.10</version><path>C:\Program Files (x86)\Cisco\Cisco NAC Agent\</path><category>Unclassified</category><process><diff>0</diff><pid>1444</pid><path>c:\program files (x86)\cisco\cisco nac agent\nacagent.exe</path><hash>502EF2A864254A2DF555E029BE2C39E94B111E8B01534D7161826650DE4CEB4D</hash></process><process><diff>0</diff><pid>2320</pid><path>c:\program files (x86)\cisco\cisco nac agent\nacagentui.exe</path><hash>DC617419F082BEAF26521E48CB410282631F93F1359E604A4D3D181A04FEE1FB</hash></process></application><application><diff>0</diff><id>293</id><name>DAEMON Tools Lite</name><vendor>Disc Soft Ltd</vendor><version>4.49.1.0356</version><path>C:\Program Files (x86)\DAEMON Tools Lite\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Digital Operatives PAINT Beta</name><vendor></vendor><version>0.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>FileZilla Server</name><vendor>FileZilla Project</vendor><version>beta 0.9.44</version><path>C:\Program Files (x86)\FileZilla Server\</path><category>Unclassified</category><process><diff>0</diff><pid>1408</pid><path>c:\program files (x86)\filezilla server\filezilla server.exe</path><hash>E8DB1409DB694A90C759F418346AE5D71014AE3513A8B865B50923AD0DFEE395</hash></process><process><diff>0</diff><pid>2348</pid><path>c:\program files (x86)\filezilla server\filezilla server interface.exe</path><hash>F57B0A7F4A9EBAACC1A67323EBB93D96FA910524FAE842953551DBA103EF71C5</hash></process></application><application><diff>0</diff><id>180</id><name>FileZilla</name><vendor>FileZilla Project</vendor><version>3.8.1.0</version><path>C:\Program Files (x86)\FileZilla FTP Client\</path><category>FileShare</category></application><application><diff>0</diff><id>39</id><name>Google Chrome</name><vendor>Google Inc.</vendor><version>55.0.2883.87</version><path>C:\Program Files (x86)\Google\Chrome\Application\</path><category>AntiPhishing,Browser</category></application><application><diff>0</diff><id></id><name>Google Update Helper</name><vendor>Google Inc.</vendor><version>1.3.24.15</version><category>Unclassified</category></application><application><diff>0</diff><id>100</id><name>Internet Explorer</name><vendor>Microsoft Corporation</vendor><version>11.0.9600.18524</version><path>C:\Program Files\Internet Explorer\</path><category>AntiPhishing,Browser</category></application><application><diff>0</diff><id></id><name>Java 7 Update 79</name><vendor>Oracle</vendor><version>7.0.790</version><path>C:\Program Files (x86)\Java\jre7\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Java 8 Update 91</name><vendor>Oracle Corporation</vendor><version>8.0.910.15</version><path>C:\Program Files (x86)\Java\jre1.8.0_91\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Java Auto Updater</name><vendor>Oracle Corporation</vendor><version>2.8.91.15</version><category>Unclassified</category></application><application><diff>0</diff><id>111</id><name>Java</name><vendor>Oracle Corporation</vendor><version>7.0.790.15</version><path>C:\Program Files (x86)\Java\jre7\bin\</path><category>Unclassified</category></application><application><diff>0</diff><id>111</id><name>Java</name><vendor>Oracle Corporation</vendor><version>8.0.910.15</version><path>C:\Program Files (x86)\Java\jre1.8.0_91\bin\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft .NET Framework 4.6.1</name><vendor>Microsoft Corporation</vendor><version>4.6.01055</version><path>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.6.01055\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Network Monitor 3.4</name><vendor>Microsoft Corporation</vendor><version>3.4.2350.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Network Monitor: NetworkMonitor Parsers 3.4</name><vendor>Microsoft Corporation</vendor><version>3.4.2350.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148</name><vendor>Microsoft Corporation</vendor><version>9.0.30729.4148</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148</name><vendor>Microsoft Corporation</vendor><version>9.0.30729.4148</version><category>Unclassified</category></application><application><diff>0</diff><id>44</id><name>Mozilla Firefox</name><vendor>Mozilla Corporation</vendor><version>47.0.2</version><path>C:\Program Files (x86)\Mozilla Firefox\</path><category>AntiPhishing,Browser</category><process><diff>0</diff><pid>8292</pid><path>c:\program files (x86)\mozilla firefox\firefox.exe</path><hash>47F80E4FC4C43FAF468D94F5D51AAC78A125CC720FCBEA0B88B5F29D06719CE9</hash></process></application><application><diff>0</diff><id></id><name>Mozilla Maintenance Service</name><vendor>Mozilla</vendor><version>47.0.2.6148</version><category>Unclassified</category></application><application><diff>0</diff><id>298</id><name>Notepad++</name><vendor>Notepad++ Team</vendor><version>6.63</version><path>C:\Program Files (x86)\Notepad++\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3122661)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3127233)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3136000v2)</name><vendor>Microsoft Corporation</vendor><version>2</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3142037)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3143693)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Security Update for Microsoft .NET Framework 4.6.1 (KB3164025)</name><vendor>Microsoft Corporation</vendor><version>1</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>TP-LINK TL-WDN3200 Driver</name><vendor>TP-LINK</vendor><version>1.1.0</version><path>C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility and Driver\</path><category>Unclassified</category></application><application><diff>0</diff><id></id><name>Tftpd32 Standalone Edition (remove only)</name><vendor></vendor><version>0.0</version><category>Unclassified</category></application><application><diff>0</diff><id></id><name>VMware Tools</name><vendor>VMware, Inc.</vendor><version>9.4.15.2827462</version><path>C:\Program Files\VMware\VMware Tools\</path><category>Unclassified</category><process><diff>0</diff><pid>952</pid><path>c:\program files\vmware\vmware tools\vmtoolsd.exe</path><hash>5C642EF7F4EF65A0445B2C2CD227F9431835712EE7F1BD4D01D1F7472199DE47</hash></process><process><diff>0</diff><pid>1516</pid><path>c:\program files\vmware\vmware tools\vmtoolsd.exe</path><hash>5C642EF7F4EF65A0445B2C2CD227F9431835712EE7F1BD4D01D1F7472199DE47</hash></process></application><application><diff>0</diff><id></id><name>WinPcap 4.1.3</name><vendor>Riverbed Technology, Inc.</vendor><version>4.1.0.2980</version><category>Unclassified</category></application><application><diff>0</diff><id>300</id><name>WinPcap</name><vendor>Riverbed Technology, Inc.</vendor><version>4.1.0.2980</version><path>C:\Program Files (x86)\WinPcap\</path><category>Unclassified</category></application><application><diff>0</diff><id>923</id><name>Windows Backup and Restore</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>BackupClient</category></application><application><diff>0</diff><id>362</id><name>Windows Defender</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Program Files\Windows Defender\</path><category>AntiMalware</category></application><application><diff>0</diff><id>283</id><name>Windows Firewall</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>FireWall</category></application><application><diff>0</diff><id>1612</id><name>Windows Media Player</name><vendor>Microsoft Corporation</vendor><version>12.0.7601.23517</version><path>C:\Program Files\Windows Media Player\</path><category>Unclassified</category><process><diff>0</diff><pid>1596</pid><path>c:\program files\windows media player\wmpnetwk.exe</path><hash>306467D280E99D0616E839278A4DB5BED684F002AE284C3678CABB5251459CB3</hash></process></application><application><diff>0</diff><id>1587</id><name>Windows Security Health Agent</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>HealthAgent</category></application><application><diff>0</diff><id>1090</id><name>Windows Update Agent</name><vendor>Microsoft Corporation</vendor><version>7.6.7601.19161</version><path>C:\Windows\System32\</path><category>PatchManagement</category></application><application><diff>0</diff><id>1106</id><name>Windows VPN Client</name><vendor>Microsoft Corporation</vendor><version>6.1.7600.16385</version><path>C:\Windows\System32\</path><category>VPNClient</category></application><application><diff>0</diff><id>207</id><name>Wireshark</name><vendor>The Wireshark developer community</vendor><version>1.10.7</version><path>C:\Program Files (x86)\Wireshark\</path><category>Unclassified</category></application></check></package></report> ]] ...
Tutti i report sono stringhe XML. Esempio di report formattato:
<report> <version>1000</version> <package> <id>12</id> <status>1</status> <check> <chk_id>Apps_Collection</chk_id> <diff>0</diff> <application> <diff>0</diff> <id>104</id> <name>Adobe Flash Player</name> <vendor>Adobe Systems Inc.</vendor> <version>23.0.0.207</version> <path>C:\Windows\SysWOW64\Macromed\Flash\</path> <category>Unclassified</category> </application> ... <application> <diff>0</diff> <id></id> <name>Cisco AnyConnect ISE Posture Module</name> <vendor>Cisco Systems, Inc.</vendor> <version>4.4.00209</version> <path>C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\</path> <category>Unclassified</category> <process> <diff>0</diff> <pid>704</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnagent.exe</path> <hash>7D7502DE53F0282A7AFC98BE89F54D39FDEC3FAC2A1F32674C76967ADC695E09</hash> </process> <process> <diff>0</diff> <pid>1296</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseagent.exe</path> <hash>7E156520C184334D473506FFE8A482997581ACF6ABD34231FDEDC2B9A3A12066</hash> </process> <process> <diff>0</diff> <pid>3076</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\vpnui.exe</path> <hash>0131258625A16B78125EB2081E8D5678671B6DE52DDA9E0813D4674618177DC3</hash> </process> <process> <diff>0</diff> <pid>3384</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\acise.exe</path> <hash>8636F5761663A0EB9EDE263609B6AEF0EA52292E5B093AD4C453097583F365DD</hash> </process> <process> <diff>0</diff> <pid>15924</pid> <path>c:\program files (x86)\cisco\cisco anyconnect secure mobility client\aciseposture.exe</path> <hash>7FA4B3B6F688642E800AD53B865DBDCC163FBCA92D83482248DB068BA42192EA</hash> </process> </application>
... </check> </package> </report>
AnyConnect invia rapporti completi solo sulla prima connessione. Inoltre, invia solo le modifiche. Notepad++, ad esempio, è stato avviato dopo qualche tempo:
2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Received posture request [parameters: reqtype=, userip=10.62.148.162, clientmac=C0-4A-00-15-75-C8, os=, osVerison=1.2.1.6.1.4, architecture=, provider=, state=, userAgent=Mozilla/4.0 (compatible; WINDOWS; 1.2.1.6.1.4; AnyConnect Posture Agent v.4.4.00209), session_id= 2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Found a session info for endpoint C0-4A-00-15-75-C8 cisco 2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Got userid cisco from cache for endpoint C0-4A-00-15-75-C8/ 2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Report IV in Base64: JjneGgZcJbmjqMKQcy8kJg== 2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Using AES shared secret to decrypt report. 2017-01-04 19:24:37,929 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.util.CipherUtil -::::- Decrypting message using AES. 2017-01-04 19:24:37,930 DEBUG [http-bio-10.48.26.60-8443-exec-7][] cisco.cpm.posture.runtime.PostureHandlerImpl -::::- Decrypted report [[ <report><version>1000</version><package><id>12</id><status>1</status><check><chk_id>Apps_Collection</chk_id><diff>1</diff><application><diff>2</diff><id>298</id>Notepad++ <vendor>Notepad++ Team</vendor><version>6.63</version><path>C:\Program Files (x86)\Notepad++\</path><category>Unclassified</category><process><diff>0</diff>16460 <path>c:\program files (x86)\notepad++\notepad++.exe</path><hash>43E9F528CD2405E6DD117857D440A634769C6E11C4D986605354C2605B6E7D84</hash></process></application></check></package></report> ]]
Formattato:
<report> <version>1000</version> <package> <id>12</id> <status>1</status> <check> <chk_id>Apps_Collection</chk_id> <diff>1</diff> <application> <diff>2</diff> <id>298</id>Notepad++ <vendor>Notepad++ Team</vendor> <version>6.63</version> <path>C:\Program Files (x86)\Notepad++\</path> <category>Unclassified</category> <process> <diff>0</diff>16460 <path>c:\program files (x86)\notepad++\notepad++.exe</path> <hash>43E9F528CD2405E6DD117857D440A634769C6E11C4D986605354C2605B6E7D84</hash> </process> </application> </check> </package> </report>
Il file AnyConnect_ISEPosture.txt contiene tutti i log e i debug correlati. Questo file è disponibile nel pacchetto DART raccolto su un endpoint. Di seguito è riportato un esempio di report periodico, crittografato con AES256:
****************************************** Date : 01/04/2017 Time : 19:34:38 Type : Unknown Source : acise Description : Function: Authenticator::bldMonitorReport Thread Id: 0xD3C File: Authenticator.cpp Line: 724 Level: info Monitor Report: &user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1IvCqrVOplj17TAcVXEht8NkDg0OT9jM%2fTNH%2fMKllc0o6Ha5juJo4YtWDWY%2bnOancw%3d%3d. ****************************************** Date : 01/04/2017 Time : 19:34:38 Type : Unknown Source : acise Description : Function: Authenticator::buildAndSendHttpMsg Thread Id: 0xD3C File: Authenticator.cpp Line: 196 Level: debug MSG_SN_HTTP_REQUEST, {{url="https://ise22-pri.example.com:8443/auth/perfigo_validate.jsp"}, {server="ise22-pri.example.com"}, {method="post"}, {object_path=""}, {reuse_existing=1}, {close_when_done=0}, {pkt="&user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1IvCqrVOplj17TAcVXEht8NkDg0OT9jM%2fTNH%2fMKllc0o6Ha5juJo4YtWDWY%2bnOancw%3d%3d"}, {path=""}, {type=1}}. ****************************************** Date : 01/04/2017 Time : 19:34:39 Type : Unknown Source : acise Description : Function: HttpHandler::createOutgoingHTTPSMessage Thread Id: 0xD3C File: HttpHandler.cpp Line: 295 Level: debug MSG_NS_HTTP_RESPONSE, {{success=1}, {pkt="<!--error=0--><!--X-Perfigo-DM-Error=0--><!--X-Perfigo-Monitoring-Interval=5-->"}, {type=1}}.
In questo caso, AnyConnect_ISEPosture.txt contiene errori:
****************************************** Date : 01/04/2017 Time : 20:04:40 Type : Unknown Source : acise Description : Function: Authenticator::buildAndSendHttpMsg Thread Id: 0xD3C File: Authenticator.cpp Line: 196 Level: debug MSG_SN_HTTP_REQUEST, {{url="https://ise22-pri.example.com:8443/auth/perfigo_validate.jsp"}, {server="ise22-pri.example.com"}, {method="post"}, {object_path=""}, {reuse_existing=1}, {close_when_done=0}, {pkt="&user_key=dummykey&cm=10&ops=1&mac_list=C0%3a4A%3a00%3a15%3a75%3aC8&ip_list=10%2e62%2e148%2e162&hostname=TSOPREK%2dWIN7%2d1&udid=766bb955e51e4ab063fd478c63acee81260ca592&dm_report_client_IV=JjneGgZcJbmjqMKQcy8kJg%3d%3d&dm_report=2yWwY7QzHWCY%2fDVEESSAabEZtYLtxNE7QgyOOa85Dgo2Ts4ok8sIrBM37S2%2fe2Hs0URCP4KkfY4Ap8%2bh%2fqS%2biw50CZejKG%2bVbF7RTRqZyrg2veWAwvEDsSb%2bqWRRdzvZfSjS3G4ApQi07qnfExwN1Pdu7AztTn%2f3VYph9WNF1jGljXSuTFmr38e%2bvDXQnx7avYHs9meVItYqA6MecAJK3WdkBNSrK1bYjmIvzkAPqR2LuoflnA9IcNOTZQ9iN%2fknOjlLqsiV5eV6jlMSUeOakKsTwy1gbPsFz99eKdtaCMv1F%2fsAmvLApjpke0IMKorXXkvpJURtAtOMK75ltXdykC85ihgHcI10JW7mlpvIppk5MbCZjihQbXldr5%2fQVdpB8eRqMHF1iCK1gx96lwwdzBSfr%2bgrcF4072fYYNOa9cYnTFShgU%2bxrnBDcJ1GUoYE9K5nTfGQ01p4NrcbLjpM79e14v14YgfQhmSfktwxfA8pY7A6jmL3BIp3O9gmQVnoTqaaccqkW76uT%2bPkjVOyrOgdG0CYwUwUMVqpctGKorxx1C3IwXhBWUmvRY9p2LRdePRqnCN8hpiesyk%2bzTnyX0OaNdHD6%2bGEMGo9QjQvwrL9dcvrUxxHtlQcJPekXajXPfn98FpC8z%2b966tcz4DfMN6giSlEfK6y5%2bMpk0oAL%2fV4XMg296PDocGaeTK1OUR7Qkl%2b7S2fv%2fCfZdiQaTndZ6zHWuimq5JBRElmuKI9hWRN2cPERcDn64ISZZSiz9yPoJPlPPpFsfggkc2PdS0OEEtMiM%2bBjNKcFx2Tcsq76eYfDtvDq9tGzjST8opInlIiXdAzdbeWsjCAerCvS73xg2vd2DHfpFlrd5lVa3qwo3Vov3nFiAz4l3IrI1fOHjAE7rCZTy2dWU455icOjmO%2bCVAS3SzWCea4fZu3fAhmIhAVQKE1cFZ4CyyBv8934OVw62Bxu5ij0wbHOStA8TSbxJXyuGBw8cqTPfuUtqPLx6nWtcRZ6p13MuQTq%2bKZLZ7hwY2Urf1o1Gi9OPGyo5zuJZAuQInU%2bkJKU6ycXHZo17Uti3DITCy0%2fG%2bQ2gixzBIpmJctekKJO243rZiU1wbOUPWLzGum8ydRu3im2LiDisXquAu7ipY5P0D475AZN3Cd6nlIPP5MOra493QhX4Il39q%2birT1%2f5F7tI%2fKLv20fWFC%2fjKbfu%2bFe4QIbdtiSCvLkyZ%2bWDwBMWSXHGE11CoErbj4LJP3h4oqLto17riGCYMb%2bRHZXNJA2bwjcfgY4w2FE4hrL0cC6D3YgZxHHpUeT4gMXoXj0EJwODxQwElc9yfoe%2bDgJ4Fy6%2fXc0ymDFYU7oOouAc0nwPKZwhZn4Q3mMZIG5aeOFcx9IM6M47IcMMbo0r78aUk8M94h5f4sK6JxHz75B6JyTx3H%2bxFDJ3j5UtUYj1oir4CLQJgR8ABhMDGxqhAN4c4wA4y790bh2F5PxkVXMGYb4ghFNt3jIHGXRMENPTYkelnD0fa1mMmhJUXE%2fVAshJ8aZwcGCU%2fNhSkCATRXb5UDAmeaSkwe3m4bcRtfBbNZ1l5CNQVH8ZPZsKlGCNpD6dOYkSxa%2ffErYqImEzm9itwSzUujQXI%2f8%2f%2fKewc9jeBujwHqnjuIYg5sJbjk%2bqc%2fwy5hKHTbxFacnFJlgvJhHt3mht8oRC9EbbsULoAK1fvLe4%2fE%2bqFjOe02bw4sQuu1ssMKxLsNQMCTIZFzhl0K6BZdfo1RonKG0MEG1K%2ftSDNC4eyQw9ewYhgpozDVHW1yprpVY9UgcTvFVSh0Vy%2bWde4b0dtmPdhbQhvvsQOSgnxIX6a8GN4AwXEoE7CoP6%2fFZiTAJTuxUKMjC1m8iAsrAurJugnEgaKKugSNkl9y7bgSiYB6zkthDclEyBFWc1rAEcfH6oMJs59aJodXnPSAA9FuyqLCWB%2f3WFZ03efhTviz2101G8%2fsWMxR0w%2fR56oNH2wzUwkmh9oczFaYLpJPzg6k47oh1zmDJraqyvWgzzfPIipa7EKK8YvsuO4BCFgMrDZtYZnCO6B9CFoKDCNJE9Wxl%2bhTdzFCA4GpeLE4nT7y1j113iTV%2faWyImNLaRMU2ZiwuKy%2bd2OH55LqnLBCxrUUIMH7Ku4Mhd%2fYvw1NVpcZZ0L%2bWOkMoephk2XXE4OQAY7Rk%2f%2fRnCbbHlFOVQmEVOoxNneBElleajK%2fxX6C0BZBaebAVYluwdGkkktvgQ5gUvzMiyqbsvzyUMzq%2fhqKY7vVMWUeyCsBnybuGPSILJIkMgdgjiz%2baUZsOyZsUE%2b7PPyiqphqXNRfQ6tj8wTzq7a2Z5XgCYI10Piqj1mg6hY1TiRYuPanyBqh61LFKxblkpQJX2339pqB4RBOzF4%2f3CsvfjU302NSU9fypX5dBYubAZt80DOBe84FSnQIX3pfX2%2fW9LqclyWbxC2QSOfHoe6TgkCiOall%2fqUHWqeOogbgLO5s5ffBoNmUCxhJW%2fH1EqKcsFzA%2ba%2f2Q0%2bs2m99Rqlxdd55bg67LXVPGfKh2dbVHjghXjO90nLEtVwCfs8oMUIg%2bmnip%2fdA7wDz4Nsma2W0ugEhOjpfFbL2TxHLhE0r%2bwy3t%2bosvtaXNJZg84LJKpt3J%2bmc0pnIBH5S5H7zrNDKUnIYXY8BD5n1clZi4wwkRIp62avJw7lN22zNHsjp7NUjTYw9X%2f1Iti1TKxjPZuitU%2bITeCRRHzeoaeGbzE1E%2bGSSqemw7F1wx4w9JXHDajH%2bY4iX7z2Y4OrY1JQQleeS9KWzw5HdiCpuHmhMtLMSpz%2fGagw7KeaLEe9FxwrOYILS%2fXuBStZ1XOpbQHIlH0ZdQbv2I%2bA%2f3j3GvalSul%2f0YVWlPPPIC2OgkSSbd4HyXXh9TEB8dhDmfucy5VEZ5MsuOTgytkALNSK0t9cyvsAcWTQf0uVAMnyBeaMPJAvdE9fXUiH628eMD9PHvt3cL0GYdRR9WBUcszIFtJNIA5AXj7abdbc6VZ8DqX4YfJ1xgTqg2qKSJqXvtbi5BJU49BGaxu01Ta6eBo2ABLtgBxKzb8DYNYqyqRB%2bYkgr5YdU6z6va15jQJYGUJYVwZ8xDsKvYHz1fUFAHldzxkq44myNAjD1H0DoYhQaXUl20UXkgO9w5kBqTfmKj9DOJhs5Q88ilebAbHHxm3GTZSJpP51jQjsPSUi3doX3Mz8E7W5pYptxtW1XPwcSHhkxuhWjbVKKQRTgM5uSXCPQ0PDAqcc6NybV2t1BK3GhQSPzsQ5k3wkldK7CYuUWMpKTMNLZDVF8i25DoGpA0K5m5s3VMAukLA9Gob5ysU%2fsu2TVBrJZDOsa3L%2bNoF2b01f8BC32e. ****************************************** Date : 01/04/2017 Time : 20:04:41 Type : Unknown Source : acise Description : Function: hs_transport_winhttp_post Thread Id: 0xD3C File: hs_transport_winhttp.c Line: 5776 Level: debug unable to send request: 12029. ****************************************** Date : 01/04/2017 Time : 20:04:41 Type : Unknown Source : acise Description : Function: HttpHandler::createOutgoingHTTPSMessage Thread Id: 0xD3C File: HttpHandler.cpp Line: 295 Level: debug MSG_NS_HTTP_RESPONSE, {{success=0}, {pkt=""}, {type=1}}. ****************************************** Date : 01/04/2017 Time : 20:04:41 Type : Error Source : acise Description : Function: Authenticator::parsePostureData Thread Id: 0xD3C File: Authenticator.cpp Line: 257 Level: error Failed to communicate with CAS.. ****************************************** Date : 01/04/2017 Time : 20:04:41 Type : Error Source : acise Description : Function: SMNavPosture::SMP_handleMonitorResp Thread Id: 0xD3C File: SMNavPosture.cpp Line: 495 Level: error Failed to parse monitor response.
*****************************************
Il motivo più comune di avere un messaggio "nullo" durante la creazione di App Compliance dalla visualizzazione EP è l'assenza dei grafici OPSWAT richiesti. L'aggiornamento della postura alla versione più recente dovrebbe risolvere il problema.
Revisione | Data di pubblicazione | Commenti |
---|---|---|
1.0 |
31-Mar-2017 |
Versione iniziale |