Posture and Client Provisioning

What it is

Posture is the check that an endpoint meets your security rules before it gets full network access.

The rules might say that antivirus must run, that a disk must be encrypted, or that patches must be installed. ISE checks the device against them. Client provisioning is the part that puts the posture agent on the device in the first place.

How it works

ISE gives a limited access first, runs the check through an agent, and then changes the access to match the result.

Posture states

A posture result can have one of three values.

These states are available in authorization rules, so each one gives different access.

The posture agent

The agent is software on the endpoint that runs the checks and reports to ISE. There are two common forms:

• Cisco Secure Client posture module: A permanent agent, part of the Cisco Secure Client, also known by its older name AnyConnect. It can check again at set times.
• Temporal agent: A small agent that runs once, reports, and is removed. It suits visitors and devices that you do not manage.

Agent based posture covers desktop systems such as Windows and macOS. The agent talks to ISE over a posture protocol on TCP 8905 by default.

The three rule pattern

Posture needs three authorization rules, read from the top of the list.

1. Compliant: The posture status is compliant. Give full access.
2. Non compliant: The posture status is non compliant. Give limited access, or access to a remediation server.
3. Unknown: The posture status is unknown. Redirect to client provisioning.

The unknown rule is the one that starts the flow. A new device has no posture result, so it matches this rule and is redirected.

The posture flow

1. The device authenticates, for example with 802.1X.
2. ISE has no posture result, so it returns a redirect to the client provisioning portal, with a redirect ACL.
3. The user opens a browser and is redirected to the portal.
4. The portal checks for the agent. If it is missing, the user downloads it. If it is installed, it starts.
5. The agent finds the policy service node and gets the posture policy that applies.
6. The agent runs the checks and sends the result.
7. ISE records the posture state and sends a CoA to the device.
8. The device authenticates again, and the compliant or non compliant rule matches.

The switch settings are the same as for central web authentication. That means the redirect ACL, the web server, and a dynamic author entry for CoA.

Switch(config)# ip http server
Switch(config)# ip http secure-server
Switch(config)# aaa server radius dynamic-author
Switch(config-locsvr)# client 10.1.1.11 server-key SECRET

Client provisioning

Client provisioning decides what to install on a device. The policy is in the client provisioning area of the policy menu. Each rule picks a device type and operating system, and names the agent configuration to deliver.

A typical agent configuration includes:

• The agent software itself.
• The compliance module, which holds the checks the agent can run.
• A posture profile that tells the agent how to find ISE.

Resources can be downloaded from the Cisco site, or uploaded from a file. Keep them current, because an old compliance module may not know about new antivirus products.

Posture license

Posture is a licensed feature. Check the license tier for your ISE release, since the higher tiers cover posture.

Verify

On ISE, open the live logs. A device in the posture flow shows a first authentication with a redirect, a posture status, and then a second authentication with the final result. The reports list the posture assessments and what failed.

Switch# show authentication sessions interface GigabitEthernet1/0/5 details

The details show the redirect while the device is unknown, and the final policy after the check.