了解ISE中的终端安全评估租用

下载选项

  • PDF     (969.0 KB)
    在各种设备上使用 Adobe Reader 查看
已更新: 2026 年 8 月 19 日
文档 ID:222876

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。 请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍在Cisco ISE中配置终端安全评估租用。

先决条件

要求

  • 思科ISE中的状态流量知识
  • 思科ISE中的AAA策略知识

使用的组件

本文档中的信息基于以下软件和硬件版本：

  • Cat9300交换机版本17.9.5
  • 身份服务引擎(ISE)v3.2
  • 带ISE终端安全评估模块5.1.6的PC Windows 10企业版

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

背景信息

安全评估租赁是思科ISE的一项功能，在数据库中存储最近一次已知合规状态达365天，并且不会联系终端检查合规性。但是，当安全评估租赁到期时，思科ISE不会自动触发终端的重新身份验证或安全评估重新评估。由于使用的是同一会话，终端将保持相同的合规状态。当终端重新身份验证时，运行状态并重置状态租用时间。

终端安全评估租赁是在Oracle DB中存储的终端属性，并以EPOCH时间存储时间。也可以通过情景可视性和Oracle DB验证相同内容。

Posture Expiry

除了安全评估租用，ISE中还有一项功能可缓存上次已知合规状态，该功能可配置时间量（最长200天/4800小时/288000分钟）配置为上次已知安全评估合规状态。此功能允许思科ISE缓存上次合规状态，如果终端在上次已知安全评估合规状态内变为不合规，ISE会将终端标记为合规，直到在安全评估策略中配置的宽限期为止。

Last Known Posture Compliant State值存储在Oracle数据库中，也存储在EPOCH时间中。

配置

要在Cisco ISE中配置终端安全评估租用，请执行以下操作：

1.定位至工作中心>状态>设置>状态租赁。检查每__天执行状态评估，并配置天数（1-365天）。 在本例中，它设置为1天。

2.选中Cache Last Known Posture Compliant Status并配置Last Known Posture Compliant State时间（最长200天/4800小时/288000分钟）。 在本例中，它配置为2天。

Posture Lease Configuration

3.为简单起见，仅启用一个安全评估策略（Windows FW检查），宽限期为2分钟。

Posture Policy - Grace Period Settings

验证

终端首次连接且符合要求。

Verify Endpoint Connects and is Compliant

Compliant Status

ISE-PSC.log（调试中的终端安全评估）

在ise-psc.log中，您可以看到EP首次连接时，DB中没有到期时间：

2024-11-30 22:55:08,485 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-8][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019::::- posture expriy time retrieved from DB is "" for B4-96-91-26-EB-A1
2024-11-30 22:55:08,485 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-8][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019::::- PostureExpiry value for B4-96-91-26-EB-A1 is not a number :

EP通过状态检查处理并变为合规。EP合规后，ISE将更新数据库，到期时间为1天(1733073953816):

2024-11-30 22:55:55,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019:alice:::- posture_bypass_test is null fast reconnect expiry time is1733073953816 2024-12-01T22:55:54.306+0530
2024-11-30 22:55:55,307 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000147BE04019:alice:::- updating fast reconnect for end point B4:96:91:26:EB:A1 with 1 days of expiry time1733073953816 <------Updating posture lease in DB (EDF_POSTUREEXPIRY)
2024-11-30 22:55:55,307 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- updated posutre lease for session 08C9C50A000000177E20CE15

此外，ISE使用宽限期到期时间1733160354306（2天）更新数据库：

2024-11-30 22:55:55,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000147BE04019:alice:::- Starting new thread for updateGracePeriodTime
2024-11-30 22:55:55,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000147BE04019:alice:::- remove user from expiry list
2024-11-30 22:55:54,306 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000147BE04019:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], <---- grace period expiry time 1733160354306 <----------- Updating last known compliance status in DB (LAST_COMP_EXPIRY)

重新连接EP后，会话直接成为投诉。启用终端安全评估租用时，ISE从数据库检索终端安全评估到期时间并将会话标记为合规：

Session Becomes Compliant

2024-11-30 23:04:17,673 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-11-30 23:04:17,673 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-11-30 23:04:17,677 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Querying posture expiry time by MAC B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture expriy time retrieved from DB is "1733073953816" for B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture lease expiry time 1733073953816 2024-12-01T22:55:53.816+0530 for B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- retrieved fast reconnect expiry time 1733073953816 2024-12-01T22:55:53.816+0530 for B4-96-91-26-EB-A1
2024-11-30 23:04:17,679 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- B4-96-91-26-EB-A1 is within fast reconnect expiry
2024-11-30 23:04:17,680 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PosturePolicyUtil -:::::- User null belongs to groups NAC Group:NAC:IdentityGroups:Endpoint Identity Groups:Profiled:Workstation,NAC Group:NAC:IdentityGroups:Any
2024-11-30 23:04:17,680 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Compliant

情形 1：禁用状态租用

1.禁用安全评估租用，并启用Cache Last Known Posture Compliant Status,Last Known Posture Compliant State为2天。如果终端安全评估租赁到期且EP随后连接，则此场景也有效。

Posture Lease Status

2.在EP身份验证后，由于未启用终端安全评估租用，ISE执行终端安全评估检查：

2024-12-01 18:39:50,901 DEBUG [PolicyEngineEvaluationThread-3][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-01 18:39:50,901 DEBUG [PolicyEngineEvaluationThread-3][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is not enabled. Posture status retrieved from LSD for B4-96-91-26-EB-A1 is Unknown
2024-12-01 18:39:50,901 DEBUG [PolicyEngineEvaluationThread-3][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Unknown

3.在EP合规后，ISE在宽限期到期时间1733231423117（2天）内更新数据库。

2024-12-01 18:40:23,116 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000227EB700E6:alice:::- Starting new thread for updateGracePeriodTime
2024-12-01 18:40:23,117 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000227EB700E6:alice:::- remove user from expiry list
2024-12-01 18:40:23,117 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000227EB700E6:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1733231423117 <--------------Updating last known compliance status in DB (LAST_COMP_EXPIRY)
2024-12-01 18:40:23,117 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-3][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000227EB700E6:alice:::- Starting new thread for updateLastCompExpiryTime [B4:96:91:26:EB:A1], grace period expiry time 1733057867397

Status Compliant or Pending

现在，EP变成了非控诉。与状态策略一样，仅检查Windows FW。

4.禁用Windows FW并重新连接EP。EP变为无抱怨，但是，安全评估策略中配置了2分钟的宽限期。因此，AC终端安全评估模块将状态显示为In grace period。

EP Becomes Non-Complaint

5.在RADIUS实时日志中，您可以看到EP被标记为投诉，即使状况检查失败。宽限期到期后，会话变为不合规状态。

EP Marked as Compliant

6.在ise-psc.log中，您可以看到EP何时连接，因为租用未启用，它会检查LSD以检索终端安全评估状态：

2024-11-30 23:26:16,482 DEBUG [PolicyEngineEvaluationThread-16][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-11-30 23:26:16,482 DEBUG [PolicyEngineEvaluationThread-16][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is not enabled. Posture status retrieved from LSD for B4-96-91-26-EB-A1 is Unknown
2024-11-30 23:26:16,483 DEBUG [PolicyEngineEvaluationThread-16][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Unknown

7.执行状况检查，但EP失败。之后，ISE检查数据库以检索lastCompliantExpiry值，该值是1733160354306（2天）。

2024-11-30 23:27:19,123 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- Last compliant expiry period for device with mac: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 has not expired lastCompliantExpiry: 1733160354306.

8.由于lastCompliantExpiry仍然有效，它进一步检查配置为2分钟的安全评估策略上配置的宽限期。

2024-11-30 23:27:19,123 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- handleGracePeriod - calculateGracePeriod: B4-96-91-26-EB-A1.

2024-11-30 23:27:19,544 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- calculateGracePeriod - matched policy: Default_Firewall_Policy_Win with grace period: 2 for mac: B4-96-91-26-EB-A1
2024-11-30 23:27:19,544 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- calculateGracePeriod - grace period is: 2 for mac: B4-96-91-26-EB-A1

2024-11-30 23:27:19,546 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000147BE04019:alice:::- Added user with mac B4-96-91-26-EB-A1 udid 6d8a638f9acadd2851a6cd7eae947060a898ebc1 grace period list with an expiration time of 2024/11/30 23:29:19 and startTime of 2024/11/30 23:27:19 <---------------- Updating the Grace period in DB (LAST_GRACE_EXPIRY)
2024-11-30 23:27:19,546 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- handleGracePeriod - device with mac: B4-96-91-26-EB-A1 - has grace period: 2 mins.
2024-11-30 23:27:19,546 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- Device with session id: 08C9C50A0000001A7E3D5087, client mac: B4-96-91-26-EB-A1 - has grace period: 2. Marking posture status as compliant

9.宽限期结束后，AC模块将失败的报告发送到ISE。ISE检查数据库中的宽限期并发现其已过期。然后，它将会话标记为非投诉，并从数据库删除LastCompExpiryTime和GracePeriodTime:

2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- value from cache 1732989439545 and db 1732989439545
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- getGracePeriodAndUpdate - StartTime 1732989439545
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- Calculated the GracePeriod exp in min 0
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000177E20CE15:alice:::- GracePeriod value is 0 and removeUser
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000177E20CE15:alice:::- Starting new thread for updateGracePeriodTime
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.runtime.GracePeriodManager -:08C9C50A000000177E20CE15:alice:::- remove user from expiry list
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000177E20CE15:alice:::- Starting new thread for updateLastCompExpiryTime
2024-11-30 23:29:23,289 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-4][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000177E20CE15:alice:::- Starting new thread for updateGracePeriodTime

10.如果EP重新连接且变为无抱怨，ISE不会执行安全评估策略的宽限期。由于最后一个合规期已过期，因此会话会直接更新为Non-Complaint。

2024-12-01 00:49:40,004 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000177E20CE15:alice:::- handleGracePeriod - Last compliant period expired for device with mac: B4-96-91-26-EB-A1.

方案 2：禁用安全评估租赁以及缓存上次已知安全评估合规状态

Disable Posture Lease

1.在这种情况下，默认情况下，ISE将数据库中的上次合规性更新为365天。

2.由于未启用安全评估租用，因此在ISE将数据库中的最后合规到期时间更新为365天后，将进行安全评估检查，并且EP会成为投诉。

2024-12-01 00:58:17,191 DEBUG [PolicyEngineEvaluationThread-12][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-01 00:58:17,191 DEBUG [PolicyEngineEvaluationThread-12][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is not enabled. Posture status retrieved from LSD for B4-96-91-26-EB-A1 is Unknown
2024-12-01 00:58:17,191 DEBUG [PolicyEngineEvaluationThread-12][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- PostureStatusPIP for mac B4-96-91-26-EB-A1 - Attribute Session.PostureStatus value is Unknown

2024-12-01 00:58:56,722 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.PostureHandlerImpl -:08C9C50A000000147BE04019:alice:::- handleGracePeriod - Device is compliant. Removing device with mac: B4-96-91-26-EB-A1 from grace period map

2024-12-01 00:58:56,723 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000147BE04019:alice:::- Last cache time period is not set, setting lastCompliant expiry time to 365 days
2024-12-01 00:58:56,723 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A000000147BE04019:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1764530936723 <------------Updating last known compliance status in DB (LAST_COMP_EXPIRY)
2024-12-01 00:58:56,723 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-10][[]] cisco.cpm.posture.edf.PostureUdid -:08C9C50A000000147BE04019:alice:::- Starting new thread for updateLastCompExpiryTime

情形 3：轻量级会话目录(LSD)对终端安全评估租用的影响

1.启用或禁用LSD不会影响状态租用和上次符合性状态，因为这两个属性都存储在Oracle数据库中并在整个部署中复制。而LSD在内存中存储有限的EP属性，并复制到其他PSN。

启用LSD时：

2.要启用LSD，请导航到管理>系统>设置>光数据分发>检查RADIUS会话目录。

Enable LSD

3. EP首次连接并处理状态检查。EP合规后，它会更新状态租用和数据库中最后一个已知合规属性：

2024-12-02 19:36:43,274 DEBUG [PolicyEngineEvaluationThread-11][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 19:36:43,276 WARN [PolicyEngineEvaluationThread-11][[]] cisco.cpm.posture.runtime.PostureManager -:::::- Cannot find endpoint B4-96-91-26-EB-A1 in end point DB
2024-12-02 19:36:43,276 INFO [PolicyEngineEvaluationThread-11][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- not able to find user name in posture pip for B4-96-91-26-EB-A1 08C9C50A0000002B87B7D6EC. Set posture status to unknown

2024-12-02 19:37:27,164 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-5][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A000000227EB700E6::::- posture expriy time retrieved from DB is "" for B4-96-91-26-EB-A1



2024-12-02 19:37:29,110 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A0000002B87B7D6EC:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1733321249110 <--------------------Updated last known compliance status in DB



2024-12-02 19:37:29,113 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002B87B7D6EC:alice:::- posture_bypass_test is null fast reconnect expiry time is 1733234849113 2024-12-03T19:37:29.113+0530
2024-12-02 19:37:29,113 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-6][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002B87B7D6EC:alice:::- updating fast reconnect for end point B4:96:91:26:EB:A1 with 1 days of expiry time 1733234849113 <------Updated posture lease in DB

4.这些是分布在PSN上的LSD中的属性。您无法在属性中看到状态租用或上次合规状态：

2024-12-02 19:37:32,221 DEBUG [LSD-consumers-pool-28][[]] cisco.cpm.lsd.service.SessionDirectory -:::::- Updating session sessionID:[08C9C50A0000002B87B7D6EC] status:[Authenticated] randomId:[0352b361-e72a-40e7-a0c8-b1ef779f73a5] auditSessionID:[08C9C50A0000002B87B7D6EC] accountingSessionID:[null] endpointMAC:[B4-96-91-26-EB-A1] callingStationId: [B4-96-91-26-EB-A1] endpointIP:[10.197.201.180], IPv6 : [[]], psnIP:[10.127.197.170] psnFQDN: [labpsn01.vmlab.local] deviceIP:[10.197.201.8] destinationIP:[10.127.197.170] nasIP:[10.197.201.8] nasIPv6:[null] postureStatus: [Compliant] timeStamp:[1733148451] cts:security-group-tag:[7] cts:vn:[null] proxyFlow:[null] retry count : 1

5.现在，使用部署中的另一个PSN对EP进行身份验证。身份验证请求到达另一个PSN后，您可以看到PSN从数据库检索状态租用时间，并将会话直接标记为合规。也可以从实时日志中验证相同情况：

2024-12-02 20:08:27,449 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-02 20:08:27,449 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 20:08:27,468 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Querying posture expiry time by MAC B4-96-91-26-EB-A1
2024-12-02 20:08:27,471 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture expriy time retrieved from DB is "1733234849113" for B4-96-91-26-EB-A1
2024-12-02 20:08:27,471 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture lease expiry time 1733234849113 2024-12-03T19:37:29.113+0530 for B4-96-91-26-EB-A1
2024-12-02 20:08:27,472 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- retrieved fast reconnect expiry time 1733234849113 2024-12-03T19:37:29.113+0530 for B4-96-91-26-EB-A1
2024-12-02 20:08:27,472 DEBUG [PolicyEngineEvaluationThread-5][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- B4-96-91-26-EB-A1 is within fast reconnect expiry

PSN Marks Session as Compliant

当LSD被禁用时：

1.要禁用LSD，请导航到管理>系统>设置>光数据分发>取消选中RADIUS会话目录。

Disable LSD

2. EP首次连接并通过状态进行处理。EP合规后，它会更新状态租用和数据库中最后一个已知合规属性：

2024-12-02 20:40:10,417 DEBUG [PolicyEngineEvaluationThread-9][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 20:40:10,423 WARN [PolicyEngineEvaluationThread-9][[]] cisco.cpm.posture.runtime.PostureManager -:::::- Cannot find endpoint B4-96-91-26-EB-A1 in end point DB
2024-12-02 20:40:10,423 INFO [PolicyEngineEvaluationThread-9][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- not able to find user name in posture pip for B4-96-91-26-EB-A1 08C9C50A0000003087F1EE30. Set posture status to unknown



2024-12-02 20:40:45,679 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.GracePeriodUtil -:08C9C50A0000002E87E4FE87:alice:::- updating grace period for device with udid: 6d8a638f9acadd2851a6cd7eae947060a898ebc1 , maclist: [B4:96:91:26:EB:A1], grace period expiry time 1733325045679<--------------------Updated last known compliance status in DB (LAST_COMP_EXPIRY)



2024-12-02 20:40:45,682 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002E87E4FE87:alice:::- posture_bypass_test is null fast reconnect expiry time is 1733238645682 2024-12-03T20:40:45.682+0530
2024-12-02 20:40:45,682 DEBUG [https-jsse-nio-10.127.197.170-8445-exec-1][[]] cisco.cpm.posture.runtime.PostureManager -:08C9C50A0000002E87E4FE87:alice:::- updating fast reconnect for end point B4:96:91:26:EB:A1 with 1 days of expiry time 1733238645682<------Updated posture lease in DB (EDF_POSTUREEXPIRY)

3.现在，使用部署中的另一个PSN对EP进行身份验证。身份验证请求到达另一个PSN后，您可以看到PSN从数据库检索状态租用时间，并将会话直接标记为合规。您可以从实时日志中验证这一点：

2024-12-02 20:49:56,115 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Posture status in session is not compliant
2024-12-02 20:49:56,115 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- fast reconnect is enabled
2024-12-02 20:49:56,119 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- Querying posture expiry time by MAC B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture expriy time retrieved from DB is "1733238645682" for B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.runtime.PostureManager -:::::- posture lease expiry time 1733238645682 2024-12-03T20:40:45.682+0530 for B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- retrieved fast reconnect expiry time 1733238645682 2024-12-03T20:40:45.682+0530 for B4-96-91-26-EB-A1
2024-12-02 20:49:56,123 DEBUG [PolicyEngineEvaluationThread-10][[]] cisco.cpm.posture.pip.PostureStatusPIP -:::::- B4-96-91-26-EB-A1 is within fast reconnect expiry

Final Posture Status

从这两个场景中，您可以确认LSD不会影响状态租用。

常见问题解答

问:状态租用和缓存的上次已知状态是否彼此独立？

A：是，无需启用缓存的上次已知安全评估即可启用安全评估租用，反之亦然。终端安全评估租用将终端合规性状态保存为配置时间内的终端属性。缓存的上次已知终端安全评估是在数据库内保存的时间，在该时间内，如果终端变为不合规（这不是终端属性），将指定宽限期。

问:是否将终端安全评估租用和缓存的上次已知终端安全评估复制到节点上？

A:状况租用是一个终端属性，在所有节点上复制。Cached Last Known Posture不是终端属性，但是，该值在Oracle DB中，也会复制到所有节点。

问：重新启动节点是否会删除这些值？

答：否，因为这两个节点都保存在Oracle数据库中，重新加载这些节点不会删除这些值。

问：安全评估租赁是否会导致任何安全问题？

A：启用终端安全评估租用时，ISE不检查终端的安全评估状态。如果终端不合规，则可能导致安全问题，ISE可以将其视为投诉。建议使用终端安全评估与终端安全评估租用，以最大程度降低此风险。

已知缺陷

  • Cisco Bug ID CSCwk07454 - PSN不会使用正确的终端安全评估租用到期时间更新数据库
  • Cisco Bug ID CSCwi58421 - PSN节点在启用状态租用时不会使用正确的状态过期时间更新数据库

修订历史记录

版本 发布日期 备注
2.0
19-Aug-2026
更新了简介、拼写、语法、插入水平线以分隔各部分的可读性、固定URL和CCW错误。
1.0
20-Mar-2025
初始版本
TAC Authored

由思科工程师提供

  • 斯瓦贾尔·萨尔卡尔
    技术咨询工程师

此文档是否有帮助?

Feedback反馈

联系我们

本文档适用于以下产品