Endpoint Compliance · Topic 3 of 3
The Posture Work Center
Use the ISE Posture Work Center to configure and run posture services, from settings and updates to client provisioning, policy, reports and testing.
- 5 min
- The Posture Work Center groups posture tasks in one place of the portal.
- Menu names can differ by release, but the tasks are the same.
- Run posture updates first, so the compliance module and support lists are current.
What it is
The Posture Work Center is a part of the ISE portal that gathers the posture tasks in one place.
Instead of visiting several menus, you work through a set of pages in order. The pages cover the settings, the resources, the policy, the reports and the troubleshooting tools.
How it works
The work center follows the order in which you build and test posture.
Where to find it
The work center is under the Work Centers menu, and it is named Posture. It has an overview page, and tabs or menus for the main tasks.
The names of the menus can differ between ISE releases, so use the overview page to find your way. The tasks are the same in each release.
Step 1: settings
Start with the posture settings. Here you control how the posture service behaves.
| Setting | What it does |
|---|---|
| Updates | Downloads the compliance module and support lists |
| Reassessment | Sets the interval for checking again |
| Acceptable use policy | Shows a page that the user must accept |
| General | Timers and options for how long a result lasts |
Run the updates first. Without them the posture checks cannot recognise current products.
Step 2: network devices
Posture needs network devices that support redirection and CoA. Make sure each switch or controller is in the network device list, and that the shared secret is correct. In the work center you can reach the same network device pages that you use for other work.
Step 3: client provisioning
Add the resources, then write the client provisioning rules. These steps were covered on the previous page. In the work center they are grouped under client provisioning, so you can finish them in one place.
Step 4: posture policy elements and policy
Create the conditions, remediations and requirements. Then write the posture policy that applies them. In the work center these are grouped under the policy elements and the posture policy.
Step 5: authorization policy
Write the rules for compliant, non compliant and unknown devices. The policy sets of the work center include a place for these. The unknown rule redirects to client provisioning.
For the redirect, the authorization profile sets web redirection of the type for client provisioning, with the redirect ACL name.
Switch(config)# ip access-list extended REDIRECT-ACL
Switch(config-ext-nacl)# deny udp any any eq domain
Switch(config-ext-nacl)# deny ip any host 10.1.1.11
Switch(config-ext-nacl)# permit tcp any any eq www
Switch(config-ext-nacl)# permit tcp any any eq 443This is the same redirect ACL pattern that you saw for central web authentication. The address 10.1.1.11 stands for the PSN.
Step 6: test with a client
Connect a test device. Watch the flow in the live logs, in order.
- The first authentication, with the redirect.
- The agent download or start, on the client.
- The posture result.
- The CoA.
- The second authentication, with the final access.
If a step does not appear, that step is the one to troubleshoot.
Reports
The work center has reports on posture. They show assessments by endpoint, by requirement and by failure reason.
Use them to see which requirements fail most. Start with the failed assessments.
Troubleshooting tools
The work center also holds troubleshooting pages. They help you find out why a device is stuck, for example whether the agent reached the PSN or which policy matched.
On the client, the agent keeps log files. The live logs on ISE give the policy view, and the agent logs give the endpoint view. Use both.
Common causes of a stuck device
| Symptom | Likely cause |
|---|---|
| No redirect | Redirect ACL wrong, or web server off on the switch |
| Redirect but no agent | Client provisioning rule missing for this device |
| Agent cannot find ISE | Posture profile settings or DNS wrong |
| Result but no change | CoA failed |
Verify on the switch
Switch# show authentication sessions interface GigabitEthernet1/0/5 details
Switch# show ip access-listsWork from the top of the flow down. Most posture faults happen early, at the redirect, and the later steps never start.
What to remember for the exam
Seven facts cover this topic.
- The Posture Work Center groups posture tasks in one place of the portal.
- Menu names can differ by release, but the tasks are the same.
- Run posture updates first, so the compliance module and support lists are current.
- You configure settings, client provisioning, conditions, requirements, policy and authorization.
- The authorization rules cover compliant, non compliant and unknown devices.
- Test the flow in order, using the live logs on ISE and the agent logs on the client.
- The posture reports show failures by endpoint and by requirement.
Menu paths and page names change between ISE releases. Treat the structure here as a guide and check the screens of your own release.
Common mistakes
These four mistakes are common.
Skipping the updates. The compliance module is old, and checks fail.
Forgetting the network device. The redirect and CoA never work.
Testing only the final state. You miss the step that actually failed.
Ignoring the agent logs. The endpoint side of a fault stays hidden.
Check yourself
Work through these three questions.
Which step should you run first in the Posture Work Center?
Run the posture updates, so the compliance module and support lists are current.
Which rule redirects a new device to client provisioning?
The unknown rule in the authorization policy.
Where do you see the policy side and the endpoint side of a posture fault?
In the live logs on ISE for the policy side, and in the agent logs on the client for the endpoint side.
Topic 3 of 3 in Endpoint Compliance
Test yourself on Endpoint Compliance
The full Cisco CCNP 300-715 SISE question bank has 852 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.