NAC Agent is not responding to ISE

Hi All,
Cisco NAC Agent got downloaded to the client during client provisioning. After that also Posture status is showing as 'Not applicable'.
Also Redirection is only happening if i type any ip address ex.1.1.1.1 on the browser. if i type google.com, its not redirecting.
ISE is in Cluster mode 1 Admin, 1 Monitor, 1 PSN. Version 1.2.1.198.
Note: Before the upgrade it was showing 'Posture Pending' status. 

what is the NAC version?
could be a bug CSCuq52821

Similar Messages

  • LabManager "Agent is not responding"

    Hi!
    In LabManager on Resources => Hosts one of my machines is marked as "Agent is not responding". I've tried various things:
    Rebooted
    service vsla-agent restart
    uninstall-labmanager together with rpm -ivh VMware-labmanager-agent-3.0.1.378-0.i386.rpm
    Nothing seems to help. One thing I suspect is that it's actually up, but inaccessible due to the firewall in the ESX.
    Any suggestions?
    /Tomas

    This is the solution to the problem. On the LabManager machine, there is a package that can be used to reinstall the agent. Do the following:
    Uploading
    Open the DataStore browser for the machine thats broken (upload window). Locate the following file on the labmanager server:
    labmanager\c$\Program Files\VMware\VMware Lab Manager\Agent\agent-install.bin. Upload the file.
    Preparing for execution
    The newly uploaded file is located on the ESX server, but it's not executable. Open a terminal window and execute
    cd /vmfs/volumes/your_path/
    Next, do:
    chmod 755 agent-install.bin
    Starting the installation
    Finally, execute the installation package:
    ./agent-install.bin
    This will output the following:
    verifying installer files... ok
    extracting files...done.
    running installer.
    checking for existing installation...not detected.
    starting install...
    checking for running as root... ok
    checking for resolvable hostname... ok
    checking for valid localhost entry... ok
    checking for running vmware-hostd... ok
    checking for incompatible esx version... ok
    checking for supported esx version... ok
    checking for esx license... ok
    checking for vmkernel... (warning: see below)
    checking for existing nfs datastores... ok
    checking for free disk space... ok
    checking for conflicting rpm... ok
    checking for existing RPM directory... ok
    Installing/upgrading rpms...
    Enabling firewall access for VMware Lab Manager Agent...
    (A pause in output may occur if you have disabled the ESX firewall
    and you are running this installer via a remote shell. If this is
    the case, press enter to resume installer output)
    Firewall settings updated successfully for Lab Manager access.
    VMware Lab Manager Agent installation complete.
    To uninstall agent, run:
    uninstall-labmanager
    as root.
    /Tomas

  • DPM failed to communicate with the protection agent on DPM 2010 SERVER because the agent is not responding. (ID 43 Details: Internal error code: 0x8099090E)

    Hi everyone,
    Backup jobs for protected members are intermittently failing with the following error on the DPM server:
    DPM failed to communicate with the protection agent on <DPM 2010 SERVER> because the agent is not responding. (ID 43 Details: Internal error code: 0x8099090E)
    Why does the DPM server failing to see it's own DPM agent cause the backup job for another server to fail? One day a backup will work fine, the next it may fail; and the next back to normal again...
    The following error is recorded in the Service Control Manager event log on the DPM server just prior to the above error:
    A timeout was reached (30000 milliseconds) while waiting for the DPMRA service to connect.
    Thank you.
    With regards,
    Rob

    Hello,
    I have read these entire postings and see that my problems match most of the above problems. 
    I believe we have tried all of the ideas in this blog and lots of other ideas from other forums and internet searches.
    We have about 80 small databases protected and set at 15 minute incremental and most will work but some fail.  When they fail the most common, but not only error, is something like "DPM
    failed to communicate with the protection agent on <DPM 2010 SERVER> because the agent is not responding. (ID 43 Details: Internal error code: 0x8099090E)". The alert is inactivated in the DPM Console, and the backups resume as normal."
    Since later jobs are successful I thought all was well.  All was well until I went to restore from incremental backups.  We worked for two days (day and night work) to restore
    from a corrupted virtual disk on our SQL Server 2008 R2.  I suspect DPM had something to do with the corrupted virtual disk.  All I know is that we never had this problem until installing DPM.  Here is what we encountered when we went to restore
    from the protection points: 
    *  Restore jobs take a minimum of 15 minutes for jobs that are 45 MB or 2 GB. 
    *  If you pick a backup from the list of recovery points that is not valid the job runs for 15 minutes and then "Failed". 
    *  You cannot rerun the job because SQL Server 2008 has the table being recovered as <tablename> (recovering) and a retry will not work.  Of course time is wasted while waiting
    to see if it worked.
    * Eventually you realize that even after dropping the table in the (recovering) mode in SQL that the restore point must be bad or possibly one of this failed recovery points.
    * So begins the quest to start restoring recovery points one by one and 15 minutes by 15 minutes until you find one that actually restores to a SQL Instance.
    *  If you have 80 of these to do and you average trying three recovery points and each takes 15 minutes, not to mention the time to drop the table in SQL, well that time adds up to 3,600
    minutes of trial and error.  60 hours of trial and error, wow not much of a savings using DPM over a SQL backup plan.
    * And then you have to explain to your customers that their databases were restored but you do not know at what point the DB was restored. 
    All in all it seems like DPM concept is great but like many backups the backup plan looks good on paper but actually restoring a backup is quite a different matter.
    I don't know if anyone has ever solved the problems presented in this forum but if they have then I wish they would post and if no one has solved the problem then shame on DPM.
    Good luck everyone, but I for one have spent about two months on trying to protect and restore consistently.  I have never had one day of consistent and reliable restore points.  I
    am going back to sql management plans for my backups.  I have never, in 10 years had a sql generated backup fail me.  Never.
    gbl

  • NAC Agent and NSP provisioning with ISE 1.1.1

    I am trying to get all workstations (OSX and Windows) to install both the Native Supplicant Wizard and NAC Agent during the On-boarding process.
    I am currently using the default guest portal in ISE.
    The environment has been setup using a Dual SSID design.
    At the moment, devices can connect to the provisioning SSID and get CWA. Device registration works, the portal runs the NSP setup which correctly sets up the network adapter.
    The problem is the portal never attempts to install the NAC Agent.
    The client provisioning policy has a separate policies for wireless/wired as well as OS. Each policy applies both a NSP and NAC Agent configuration. It appears the guest portal only checks the NSP configuration and not the NAC Agent config.
    Any ideas?

    Just so i understand this correctly you are using both a client provisioning portal and a native supplicant provisoning portal tied into seperate authz policies.
    With that out of the way are you checking to see if the client is compliant in the client provisioning portal policy.
    Let me know if you have the following configured (example windows OS), this is assuming that the endpoint is statically assigned to RegisteredDevices after native suppliant provisioning.
    Rule 0 (endpoint group = RegisteredDevice) AND (AD:Domain user and authentication method:x509 and posturestatus:COMPLIANT) = Permit Access
    Rule 1 (endpoint group = RegisteredDevice) AND (AD:domain user AND authentication method:x509[if you deployed certs in the native supp condition] AND workstation NOT EQUAL:COMPLIANT) RESULT client provisioning portal.
    Rule 2 (endpoint group = Workstation) AND (AD:Domain User AND authentication mehod using mschapv2) RESULT windows provisioning portal
    Hope that helps,
    Tarik Admani
    *Please rate helpful posts*

  • NAC Agent does not pop up after psn fails.

    So I'm in the middle of a deployment where I have 4 ISE appliances, two in one location and two in another location.
    The first location has 2 with all personas installed, whereas the other two are only PSN. In each area, NAC agent pops up normally after connecting/swapping to wired or wireless networks. During HA tests I have encountered that when the two ISE from the remote area fail (shutdown switch port for testing of course) the client does get authenticated but it stays in the POSTURE_REQ state on wireless and the Agent fails to pop up.
    - I have tried forcing the servers on the profile on ISE (provisioning) and I can see how it is somehow updated on the xml configuration file in the remote endpoint but still the nac agent wont pop up.
    - Increased timeout timers also, no luck.
    - Reinstalled NAC agent manually and by ise auto provisioning, no luck.
    - Ran a wireshark capture and saw requests sent to the default GW with the positron thing but never get an answer, but then I try connecting to the ISE manually https://(ADMIN_NODE_FAR_FROM_ENDPOINT)/guestportal/gateway?sessionId=(gibberish)&action=cpp and it works, so it is reachable from the endpoint
    I believe there is some kind of sync problem, my ISE are in UTC time and NADs have local timezone, but then why does it work locally??
    Any thoughts on this?
    Thank you for all your kind help

    You have done a reset. What does that mean? Did you reset all settings?
    Settings>General>Reset>Reset all Settings. You will have to enter all device settings again.

  • Nac Agent do not execute remediation

    Hi to all,
    in a lab enviroment i have configured a CAM/CAS solution on 3310 server and I have installed 2 pc (one windows Vista and one XP) with nac client 4.6.2.133 version.
    My problem is auto-remediation and manual-remediation, client get me a temporaney access but do not start a live update programa (i use symantec endpoint protection 11).
    I have admin right on both pc.
    Why I can solve the problem?
    Thanks for help

    There is not automatic remediation for all products. You must launch the endpoint protection, click live-update, then re-scan on the NAC agent and you will pass.
    Quote from Cisco Doc (http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/45/cam/m_agent.html):
    "•Not all product versions of a particular vendor may support the Clean Access Agent launching the automatic update of the product. In this case, you can provide instructions (via the Description field of the AV or AS Definition Update requirement) to have users update their AV or AS definition files from the interface of their installed AV or AS product."
    If you have verified that your requirement-rule is specifically for Symantec Endpoint Protection 11, and the rule has automatic remediation configured, then it may fall into this scenario. You may also have it configured where the endpoint protection is not accessible to the end-user and requires admin rights to launch. Please put the client in debug and send the results to TAC for analysis, as it would be the best bet for you to get a clear answer.
    Hope that helps, rate if it does.
    Cheers,
    Tim

  • Cisco NAC agent services not running on Windows XP

    Hi,
    I've problem with Cisco NAC agent services on Windows XP professional SP3.
    After first installation using user local administrator, the services of Cisco NAC agent on windows machine running well, but after logout, and login using another user which is registered in domain users, the services of Cisco NAC agent is going to stopped (going to Manual mode not automatic, and the status is stopped).
    This situation is not happened on all windows machines, several machines running well.
    Cisco NAC agent version 4.9.0.42
    Has anyone seen this type of problem?
    Below i attached windows machine information from ones running well and not running, Thanks
    Regards,
    Rian

    Hi thanks for your answers, dbconsole is started in services.msc and also Agent, but goes on to say that the agent is not running.
    In sysman log shows this,
    "03/20/2012 13:38:54,553 [MetricCollector: HOMETAB_THREAD600: 60] ERROR rt.DbMetricCollectorTarget _getAllData.328 - oracle.sysman.emSDK.emd.comm.CommException: Exception in sending Request :: null
    oracle.sysman.emSDK.emd.comm.CommException: Exception in sending Request :: null
    at oracle.sysman.emSDK.emd.comm.EMDClient.getResponseForRequest_ (EMDClient.java: 1330)
    at oracle.sysman.emSDK.emd.comm.EMDClient.getResponseForRequest (EMDClient.java: 1223)
    at oracle.sysman.emSDK.emd.comm.EMDClient.getMetrics (EMDClient.java: 640)
    at oracle.sysman.emo.perf.metric.rt.DbHomeTab._getAllData (DbHomeTab.java: 324)
    at oracle.sysman.emo.perf.metric.rt.DbHomeTab.getData (DbHomeTab.java: 139)
    at oracle.sysman.emo.perf.metric.eng.MetricCached.collectCachedData (MetricCached.java: 402)
    at
    at oracle.sysman.emo.perf.metric.eng.MetricCollectorThread.run (MetricCollectorThread.java: 320)
    at java.lang.Thread.run (Thread.java: 595)
    20/03/2012 22:00:03,335 [JobWorker 772: Thread-13] ERROR em.jobs executeCommand.161 - UpdateARUTables: Oracle MetaLink credentials are incorrect or missing. Click Patching Setup parameters required to September."
    In event viewer shows this,
    "Agent process exited abnormally DURING initialization." but this message appears a few hours after having started the service.
    I am using the Administrator account

  • Problems with the Cisco NAC agent, does not perform remediation??

    Good Morning
    I'm doing an implementation of NAC, but when the user is authenticated, the agent informs you that does not comply with defined security policies, to start the repair and re-scan the machine error appears "NAC Server is not available on the net" . The policy I am doing is to check a file on local disk C
    Deputy error screen
    I appreciate your responses as soon as possible

    the problem i have is when it moves into remediation....phase 2. If no remediation is being done (ie no checks, rules scans etc) then it moves directly from phase 1 (authentication) to phase 3 (authenticated user and assign role) and all works fine.
    I've looked under all the traffic rules and can see nothing that would mean it could not contact the CAS. There are some differences in 4.7, like the ethernet traffic filter. It seems to me when put in the temp role, the vlan should still be the auth vlan. There is a role based vlan option under edit roles, but it states that is only for normal login, not tem agent, so it should not apply.
    Im starting to think something has gone wrong with the upgrade code somewhere....TAC looked at my config  and could see nothing on a quick check, im working with them to resolve the issue

  • If A VERIZON AGENT does not respond and fix this then I am switching back to COMCAST

    I pay OVER TWO HUNDRED DOLLARS A MONTH for all these channels and every weekend when I have my only two days off to relax and watch these channels (that I pay an arm and a leg for!) ARE NOT WORKING.
    I have been taking pictures for MONTHS of the error messages I get on various channels (both basic cable channels and paid movie channels!). I have a .zip file all ready to email to show my proof of the non-working channels that I am paying for.
    Today, I've just had enough. I want reimbursement and I want this problem fixed. Technicians have come to my house and the problem still persists. Is it too much to ask for something that I pay my hard-earned money for to work properly???
    I will be switching back to Comcast if this problem is not resolved.

    I would contact Verizon via twitter (@verizonsupport).
    I have had the most success that way.
    If a forum member gives an answer you like, give them the Kudos they deserve. If a member gives you the answer to your question, mark the answer as Accepted Solution so others can see the solution to the problem.

  • ISe with NAC agent pop up and Posture waiting

    Hi,
    I have ISE running ver 1.1.1.268. We limited access certain services before authuenticate with ACL-DEFAULT(given below) as per the Trustsec desgin guide.
    Now the issue is that when you have ACL-DEFAULT on the port NAC agent doest not pop-up and doest not start the posture part and saying waiting for Posture validation. When the ACL-DEFAULT removed from the access port NAC agent popup and do the posture validation.
    However we do not want user to get access to network before the authorization and that is the reason we use the ACL-DEFAULT.
    Please can someone advise me how to achieve the above both task. Why the NAC agent does not popup and do the posture when ACL-DEFAULT there in the switch.
    Here is what I have configured on ACL-DEFAULT.
    ip access-list extended ACL-DEFAULT
    remark DHCP
    permit udp any eq bootpc any eq bootps
    remark DNS
    permit udp any any eq domain
    permit tcp any any eq domain
    permit udp any any eq 389
    permit tcp any any eq 135
    permit tcp any any eq 445
    permit udp any any eq 445
    permit tcp any any range 135 139
    permit tcp any any eq 389
    permit tcp any any eq 3268
    permit icmp any any
    remark PXE / TFTP
    permit udp any any eq tftp
    permit tcp any host 172.xx.xx.xx eq 8443 (ISE-Pri)
    permit tcp any host 172.xx.xx.xx eq 8443 (ISE-Sec)
    remark Drop all the rest
    deny   ip any any log
    Appreciate if someone can give a solid resolution and explanation to this.

    Hi Saurav,
    We have already allowed those ports with another acl (ACL-POSTURE-REDIRECT). Our issue is not with the web nac agent.
    The issue is with NAC agent installed on corperate PCs connecting via wired port. With the ACL-DEFAULT it does not pop-up and does not do the posturing, however once we removed the ACL-DEFAULT from the access port, everything works fine.
    Since we do not want any user to access unwanted services before authorization we add this ACL on the access-port and as per the trustsec desgin this has to be there if you want to have ISE with closed mode.
    thanks

  • NAC agent don't popup on some computer

    Hi
    I use
    ISE version : 1.1.1.2 and NAC agent version : 4.9.0.42
    NAC agent  does not run on some computers and run on other(windows 7).
    What can be these problems?
    Please help
    Regards

    Please look in to this , it might help you
    Agent Login Dialog Not Appearing
    Symptoms or Issue
    The agent login dialog box does not appear to the user following client provisioning.
    Conditions
    This issue can generally take place during the posture assessment phase of any user authentication session.
    Possible Causes
    There are multiple possible causes for this type of issue. See the following Resolution descriptions for details.
    Resolution
    •Ensure that the agent is running on the client machine.
    •Ensure that the Cisco IOS release on the switch is equal to or more recent than Cisco IOS Release 12.2.(53)SE.
    •Ensure  that the discovery host address on the Cisco NAC agent or Mac OS X  agent is pointing to the Cisco ISE FQDN. (Right-click the NAC agent icon, choose Properties, and check the discovery host.)
    •Ensure  that the access switch allows Swiss communication between Cisco ISE and  the end client machine. Limited access ACL applied for the session  should allow Swiss ports:
    remark Allow DHCP
    permit udp any eq bootpc any eq bootps
    remark Allow DNS
    permit udp any any eq domain
    remark ping
    permit icmp any any
    permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
    permit tcp any host 80.0.80.2 eq www --> Provides access to internet
    permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
    port
    permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    deny ip any any
    •If  the agent login dialog still does not appear, it could be a certificate  issue. Ensure that the certificate that is used for Swiss communication  on the end client is in the Cisco ISE certificate trusted list.
    •Ensure that the default gateway is reachable from the client machine.

  • NAC Agent Login Dialog Not Appearing - ISE 1.1.1 issue ?

    Agent Fails to Initiate Posture Assessment
    The NAC agent is properly installed on a Windoes 7 , IE 9 machine, the certificates from ISE ADM PRI are installed in trustable certificate store in the client machine but is a selfsigned ISE certificate.
    The reports / USER / Profiling report says the Provisioning Agent has completed the assessment ok.
    The redirected URL is working fine (SEE Evidence)
    We are always prompted to install the NAC agent again or looking at the additional prompted information wait for the NAC agent to load and complete.
    The operations status remains with postering status pending forever and nothing else happens.
    Symptoms or Issue
    The agent login dialog box does not appear to the user following client provisioning.
    Conditions Cisco Says this issue can generally take place during the posture assessment phase of any user
    authentication session.
    Cisco Advises as Possible Causes There are multiple possible causes for this type of issue. See the following
    Resolution descriptions for details of what was already tested by us and please see the atached files for your switch configuration and evidences. .
    CISCO SUGGESTED POSSIBLE CAUSES AND RESOLUTIONS
    Resolution • Ensure that the agent is running on the client machine. ALL TESTED OK
    • Ensure that the Cisco IOS release on the switch is equal to or more recent than
    Cisco IOS Release 12.2.(53)SE. - OK
    • Ensure that the discovery host address on the Cisco NAC agent or Mac OS X
    agent is pointing to the Cisco ISE FQDN. (Right-click on the NAC agent icon,
    choose Properties, and check the discovery host.) - OK (See evidence)
    • Ensure that the access switch allows Swiss communication between Cisco ISE
    and the end client machine. Limited access ACL applied for the session should
    allow Swiss ports: ALL CONFIGURED as CISCO GUIDELINES OK (SEE EVIDENCE)
    • If the agent login dialog still does not appear, it could be a certificate issue.
    Ensure that the certificate that is used for Swiss communication on the end client
    is in the Cisco ISE certificate trusted list. (ALL CHECKED OK SEE EVIDENCE)
    • Ensure that the default gateway is reachable from the client machine. (TESTED OK)

    Hi.
    Can you paste all the ACLs on your switch especially the webauth redirect ACL which should deny traffic towards the PSN.
    regards
    Zubair

  • Nac Agent Not Working on Windows 64 Bit

                       Hi All ,
    I have a Cisco ISE 3315 With Version 1.1.4 .
    We have Windows Work Station and we have some issue with Windows 7 64 Bit users !!
    On Some 64 Bit Workstation the nac Agent is getting about 25 Minute to start Checking the Posture Statu !!
    I don't Havec that Proble With 32 Bit Workstation . We are using Nac Agent 4.9.0.37 and Nac agent 4.9.0.42!!
    Here is log that i get From the 64 bit Workstation

    Hi
    Verify that supplicant is configured properly to conduct a full EAP conversation with ISE. Verify that NAS is configured properly to transfer EAP messages to or from supplicant. Verify that supplicant or network access server (NAS) does not have a short timeout for EAP conversations. Check the network that connects the NAS to ISE. If the external ID store is used for the authentication, it may be not responding fast enough for current timeouts.
    Check whether the proper server certificate is installed and configured for EAP by going to the Local Certificates page (Administration > System > Certificates > Local Certificates ). Also ensure that the certificate authority that signed this server certificate is correctly installed in client's supplicant.
    Check the previous steps in the log for this EAP-TLS conversation for a message indicating why the handshake failed. Check OpenSSLErrorMessage and OpenSSLErrorStack for more information

  • ISE/NAC posturing - WSUS not available?

    We ran into this scenario this weekend.
    We have 2 VPN sites(US and EMEA) both ASA 5515X...each site has a WSUS server (US is master, EMEA is downstream).
    VIA GPO, we have EMEA workstations set to get updates from the EMEA WSUS server. We have the VPN profiles set to rollover if one isn't available.
    (so if you try to connect to US, and it isn't responding it automatically tries the EMEA connection, and vice versa)
    We have tested the scenarios where the EMEA VPN itself is down, but the EMEA employees are still able to connect via the US, because the INTERNAL network (and its tunnel to EMEA) is still active.
    The problem that arose this weekend was, that ALL of the EMEA site was offline, including the WSUS server. So even if EMEA employees connected to the VPN, when the NAC agent checked the WSUS update status, it would time out looking for the EMEA WSUS server.
    So, as a workaround I had to tell ISE not to perform WSUS checking for the EMEA group.
    However, this is a manual process, and not acceptable in a 24/7 environment.
    Does anyone have suggestions on how to correct this single point of failure? Can you identify a secondary WSUS server on the client so that it tries to talk to both at any given time? Is there some setting in ISE?
    Honestly, this ISE implementation has been a HUGE thorn in my side....and it seems just when I think we are able to put it behind us...some other little detail comes out of the woodwork like this. I just want this to work, and make things better and smoother...not keep having little issues and it reflecting bad on myself and co-workers.
    Dirk

    Hi,
    I had the same issue and upgrading to 1.1.2 made the issue quiet down a bit. I have a few reported issues but havent seen any in the past 2 weeks. Also which supplicant is the client running and do they see these on the laptops or machines that have both wired and wireless connections?
    The reason I ask is that the native windows supplicant tends to connect to both networks (wired and wireless), this can can cause some problems with the NAC agent if the link for the wired or "the lower metric route" flaps.
    the bug cisco provided me is related to "CSCuc70607".
    Hope this helps,
    Tarik Admani
    *Please rate helpful posts*

  • Is it possible to run Posture using ISE 1.2 without NAC Agent provisioning?

    Is it possible to run Posture using ISE 1.2 without NAC Agent provisioning?
    -My customer does not want to push NAC Agent installation on BYOD type of computers (non-managed by the company computers).
    -The requirement is to check for posture only company owned wired, wireless, and VPN connected Windows computers. The rest of the endpoints should be considered as posture incompliant, and limited access to the network should be allowed.
    -No certificates are used.
    -I’ve configured the required posture check, and it all works fine if a PC has NAC Agent manually installed (without ISE Client Provisioning). However, when I use a PC without NAC Agent, it is redirected to Client Provisioning Portal and is stuck there as Client Provisioning is deliberately not configured in ISE.
    -If I remove Posture Remediation Authorization Profile that does URL redirect, the posture does not work.
    -For now I'm testing it on wired endpoints.
    Is there a way to configure ISE to fulfill the listed above requirements?
    Any ideas would be appreciated.
    Thanks,
    Val Rodionov

    Everyone who finds reads this article,
    I'm answering my own quesiton "Is it possible to run Posture using ISE 1.2 without NAC Agent provisioning?"
    The answer is Yes.
    After doing research and configuration testing I came up with a solution, and it works fine for wired and VPN connections. I expect it to work on wireless endpoints as well.
    ISE configuration:
    Posture General Settings - Default Posture Status = NonCompliant
    Client Provisioning Policy - no rules defined
    Posture Policy - configured per requirements
    Client Provisioning (under Administration > Settings) - Enable Provisioning = Enable (it was disabled in my first test)
    Authorization Policies configured as regular posture policies
    The result:
    After successful dot1x authentication posture redirect happens. If the PC does not have NAC Agent preinstalled, the browser is redirected to Client Provisioning Portal and a default ISE message is displayed (ISE is not able to apply and access policy... wait one minute and try to connect again...). At the same time, the endpoint is assigned NonCompliant posture status and proper authorization policy is applied. This is what I wanted to achieve.
    If NAC Agent was preinstalled on the PC, after successful dot1x authentication the NAC Agent pops up and performs posture check. If posture is successful, posture compliant authorization policy is applied. If posture check fails, NonCompliant posture status is assigned and posture non-compliant authorization policy is applied. Which is the expected and needed result.
    The only part that is not perfect it the message displayed to the end-user when posture is about to fail. I did not find a place to change the text of that message. I might need to open TAC case, so this file can be manually found and edited from CLI (root access).
    Best,
    Val Rodionov

Maybe you are looking for