Posture Conditions, Policy and Client Provisioning

What it is

Posture policy is the set of rules that says what a device must have, and what to do when it does not.

You build it from small parts. A condition is a single test, and a remediation is a fix.

A requirement joins conditions with remediations, and a posture policy applies requirements to the right devices.

How it works

You build conditions, then remediations, then requirements, then the policy, and then the client provisioning that delivers the agent.

Posture conditions

A condition tests one fact on the endpoint. ISE has many types, and you create them under the policy elements for posture.

Antivirus conditions use the vendor and product lists in the compliance module, so ISE does not need you to name each product by hand. Compound conditions let you build a rule such as, a firewall is on and the antivirus definitions are recent.

Remediation actions

A remediation tells the agent how to fix a failed check. It runs when a requirement is not met.

Common actions include showing a link to a page, pointing at a file to download, starting an antivirus update, and starting a patch tool. The link action is the simplest, and it often works well enough, since the user fixes the problem and clicks to check again.

Requirements

A requirement ties conditions and remediations together. It has a name, the operating system, the compliance module version, and the posture type, such as the permanent agent or the temporal agent.

A requirement also has a type:

• Mandatory: The device must pass. A failure makes it non compliant.
• Optional: The user is told, but may skip it.
• Audit: The result is recorded only. It has no effect on the status.

The posture policy

The posture policy matches requirements to devices. Each rule names an operating system, the identity group or other conditions, the posture type, and the requirements that apply.

The rule is read from the top. A device that matches a rule must pass the requirements in it. Order the rules so that the more specific ones come first.

Authorization rules for posture

The authorization policy uses the posture result. As on the previous page, you need rules for compliant, non compliant and unknown devices.

The unknown rule returns a redirect to client provisioning. The compliant rule gives full access, and the non compliant rule gives limited access, such as access to a remediation server.

Client provisioning resources

Resources are the files that client provisioning can deliver. They include the agent package, the compliance module and the temporal agent.

You add resources from the Cisco site, or from your own file. Use the posture updates feature to refresh the compliance module and the support lists for antivirus and patch tools. Run the update regularly.

Agent configuration

An agent configuration bundles the resources for a device type. It names the agent version, the compliance module, and the posture profile. The profile holds the settings that tell the agent how to find ISE.

Client provisioning policy rules

The client provisioning policy has rules like the others. A rule names the operating system, other conditions, and the result, which is the agent configuration. The first match wins.

Write a rule for each operating system you support. Place the more specific rules first.

Reassessment

A device that passed once can fall out of compliance later. A reassessment setting makes the agent check again at an interval. If the result changes, ISE sends a CoA to move the device to the new state.

Verify

In the live logs, check the posture status of a session. In the posture reports, see which requirement a device failed. If the agent does not start, check the client provisioning rule that matched.