Endpoint Compliance

What this chapter covers

Endpoint compliance is the part of ISE that checks whether a device is healthy before it gets full access.

The chapter explains the idea of posture and the way the agent reaches the device. It then covers how to build conditions, requirements and policy, and how to run the whole job from the Posture Work Center.

Posture builds on the redirect and CoA cycle from the web authentication and BYOD chapters. If those are clear, this chapter is mostly about what gets checked and how the results are used.

How the topics fit together

A device is unknown at first, is redirected, is checked by an agent, and then gets access that matches the result.

The topics follow the same order:

• Posture and client provisioning explain the states, the agents and the flow.
• Conditions and policy explain how to define the checks and the fixes, and how to deliver the agent.
• The Posture Work Center explains how to set it all up and test it in the right order.

The chapter also ties back to the policy chapter. Posture status is one more attribute that an authorization rule can match, next to identity groups and endpoint profiles. Rule order and the final catch all rule matter here just as they do there.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read the pages in order. In a lab, start with an audit type requirement on one Windows machine, and watch each step in the live logs before you make any rule mandatory.