Cisco ISE Posture

Posted Nov 5, 2024

By Sena Perdiana 7 min read

Cisco ISE posture assessment is a feature that checks the compliance status of endpoint devices connecting to the network. It ensures that these devices meet security requirements—such as having up-to-date antivirus, patches, or other mandated software—before granting them access.

There are 2 scenarios that we cover on this deployment :

Temporal Agent : It is a lightweight, temporary application downloaded each time a user logs in, used only for that session, and removed after disconnecting. This option is typically for guest users or temporary devices.
AnyConnect Agent : It is a persistent agent installed on the endpoint device, ideal for corporate-managed devices. It provides continuous posture assessment, allowing ISE to enforce security policies consistently on devices connecting to the network.

Here’s the flow of Posture Configuration

Posture Conditions : Define the specific conditions or checks that endpoints must meet (e.g., antivirus status, OS patch level).
Posture Remediations : Actions that endpoints need to take if they fail to meet the posture conditions (e.g., update antivirus, install patches).
Posture Requirements : Combine multiple posture conditions and remediations, setting compliance criteria for access.
Posture Policy : Policies applied to endpoints that determine if they are compliant or need remediation based on posture requirements.
Client Provisioning : Provisioning of the necessary agent (e.g., Temporal or AnyConnect) on the endpoint for posture assessment.
Access Policy : Final decision on access level, granting or limiting network access based on the endpoint’s compliance status.

Temporal Agent

Posture Condition

First we configure the Posture Condition on Work Centers » Policy Elements » Conditions, here we make one conditon example where windows endpoints need to have Firewall Enabled

Posture Remediation

Next the Remediation, this opstion don’t really work when using Temporal Agent but let’s configure it anyway. This Remediation Policy will automatically try to remediate when Firewall is not enabled by enabling them on endpoints

Posture Requirements

Next we put together the Condition and Remediation into a Posture Requirements, where here we configure the compliance criteria. For the remediaton we can only show a Message Text because of using the Temporal Agent

Posture Policy

Next we create a Posture Policy that points to the Posture Requirement we just made. This policy determines whether the enpdoint is compliant, requiring remediation, or not compliant

Client Provisioning

After that we configure the Client Provisioning Policy where we set what software to use for posturing. Here we create a specific rule to provision Windows 10 Endpoints to use Temporal Agent

Access Policy

Next we create a Authz Profile with ACL to only access ISE and a Web Redirection redirecting to the Default Client Provisioning Portal

the “ACL_REDIRECT” ACL must exist on the NAD

Then we create Policy Sets that govern the use cases whether the endpoint is Not Yet Postured (Unknown), Compliant, or Not Compliant

Accessing the Network

Now if an endpoint accesses the network, it will get the Posturing Policy that redirects it to the Client Provisioning Portal

On the Endpoint side, we’re redirected to the Posturing Portal

Because we don’t have any agnet installed, we’re asked to download and install the Temporal Agent

And after the check is done, we will be given the final verdict of compliant and a network access is granted

Here how the process looks like on the Live Logs

Non Compliant Endpoint

Now lets try accessing the network while having Firewall Disabled

When running the Temporal Agent again, the endpoint is not compliant. Its also showing the text message remediation