Cisco ISE Posture

Cisco ISE Posture is a feature of Cisco Identity Services Engine (ISE) that allows organizations to assess and enforce the security posture of endpoints (e.g., laptops, mobile devices) before or after granting them network access.

What is Cisco ISE Posture?

Cisco ISE Posture is part of Cisco's NAC (Network Access Control) functionality. It evaluates whether an endpoint complies with the organization's security policies (e.g., antivirus status, OS patch level, firewall status). Based on the assessment, ISE can decide to:

• Grant full access

• Redirect the device to remediation resources

• Quarantine it to a restricted VLAN

• Deny access altogether

 How It Works (Workflow)

1. User Connects to Network
   The user connects via wired, wireless, or VPN.

2. Posture Agent Involvement
   The Cisco AnyConnect Secure Mobility Client with the Posture Module checks the endpoint’s compliance status.

3. Endpoint Assessment
   Checks might include:

   1. OS type and version

   2. Antivirus/antimalware installed and running

   3. Disk encryption enabled

   4. Personal firewall enabled

   5. Presence of specific registry keys, services, files, etc.

4. ISE Policy Evaluation
   Cisco ISE receives the posture information and compares it against defined posture policies.

5. Authorization Decision
   Based on the evaluation:

   1. Compliant: Endpoint gets normal access.

   2. Non-compliant: Endpoint is placed in a remediation VLAN or portal.

   3. Unknown/Posture Pending: Limited access until posture check completes.

6. Remediation (if needed)
   The user may be prompted to update software, enable AV, or apply patches.

Use Cases

1. Enforcing Security Hygiene

   • Ensure all devices connecting to the network have up-to-date antivirus, patches, etc.

2. BYOD Control

   • Assess personal devices to ensure they meet minimum security requirements.

3. VPN Access Control

   • Enforce endpoint compliance before allowing VPN access to internal resources.

4. Granular Policy Enforcement

   • Grant different access levels based on posture state, user role, and device type.

Benefits -

Key Components

• Cisco ISE – Central policy engine and decision-maker.

• Cisco AnyConnect Client – Includes the posture module to collect device info.

• Network Access Devices (NADs) – Switches, wireless controllers, etc., that enforce the policy (e.g., redirect traffic or assign VLANs).

• Remediation Servers – Hosts software or scripts to fix non-compliant endpoints.

Configure Posture in Cisco ISE 3.1.0

Requirements

Cisco recommends that you have knowledge of these topics:

• Identity Services Engine (ISE)

• Domain Name Server

• Posture

• Windows 10 or later

Components Used

The information in this document is based on these software and hardware versions:

• Identity Services Engine (ISE) 3.1.0 or later version.

• Package Cisco AnyConnectDesktopWindows 4.10.2086.0

• Package Cisco AnyConnectComplianceModuleWindows 4.3.4390.8192

• Microsoft Windows 10 Pro 10.0.17763 Build 17763

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

ISE Posture performs a client-side evaluation. The client receives the posture requirement policy from ISE, performs the posture data collection, compares the results against the policy, and sends the assessment results back to the ISE.

ISE then determines whether device is complaint or non-compliant based on Posture Report.

Getting Started 

ISE GUI FROM MGMT-PC

IP 192.168.1.180 /24

STEP1:-

Configure Posture Conditions

Configure Application condition

Firewall condition

Cisco ISE Posture Remediation’s

STEP2:-

Cisco ISE Posture Requirements

STEP3:-

Cisco ISE Posture Policy

STEP4:-

Client Provisioning Configuration Steps

1. AnyConnect Posture Profile

2. AnyConnect Compliance Module Download from website or upload from local disk

3. AnyConnect Agent Module Upload 4.10

4. AnyConnect Profile Configuration

5. Client Provisioning Policy

AnyConnect Compliance Module AnyConnectComplianceModuleWindows 4.3.4390.8192 Download from cisco site or upload from local disk.

STEP5:-

Client Provisioning Policy

STEP6:-

Configure Downloadable ACLs for Posture_Unknown

Configure Downloadable ACLs for Posture_Non-Compliant

Configure Downloadable ACLs for Posture_Compliant

Configure Authorization Profile

Configure Authentication Policy Set

Configure Authorization Policy Set

Unknown: Redirect to client provisioning portal and restrict access

Compliant: Grant controlled access

Noncompliant: Restrict access

Go to Test PC (DOT1x-PC)

Initiate Dot1x

Installing Cisco AnyConnect on PC

SWITCH