Cisco Ise 13 User Guide

CHAPTER 23
Configure Client Posture Policies
PostureisaserviceinCiscoIdentityServicesEngine(CiscoISE)thatallowsyoutocheckthestate,also
knownasposture,ofalltheendpointsthatareconnectingtoanetworkforcompliancewithcorporatesecurity
policies.Thisallowsyoutocontrolclientstoaccessprotectedareasofanetwork.
•PostureService,page566
•PostureAdministrationSettings,page569
•DownloadPostureUpdatestoCiscoISE,page572
•ConfigureAcceptableUsePoliciesforPostureAssessment,page573
•PostureConditions,page574...

•CustomPermissionsforPosture,page587
•ConfigureStandardAuthorizationPolicies,page588
Posture Service
PostureisaserviceinCiscoIdentityServicesEngine(CiscoISE)thatallowsyoutocheckthestate,also
knownasposture,ofalltheendpointsthatareconnectingtoanetworkforcompliancewithcorporatesecurity
policies.Thisallowsyoutocontrolclientstoaccessprotectedareasofanetwork.
ClientsinteractwiththepostureservicethroughtheAnyConnectISEPostureAgentorNetworkAdmission...

ThemessagesusedinthePosturePhaseareintheNEAPB/PAformat(RFC5792).
Posture and Client-Provisioning Policies Workflow
Figure 33: Posture and Client Provisioning Policies Workflow in Cisco ISE
Posture Service Licenses
CiscoISEprovidesyouwiththreetypesoflicenses,theBaselicense,thePluslicense,andtheApexlicense.
IfyouhavenotinstalledtheApexlicenseonthePrimaryPAN,thentheposturerequestswillnotbeserved
inCiscoISE.ThepostureserviceofCiscoISEcanrunonasinglenodeoronmultiplenodes.
Posture Service Deployment...

Theothernodesthatrunotherservicesarethesecondarynodeswhichcanbeconfiguredforbackupservices
foroneanother.
Enable Posture Session Service in Cisco ISE
Before You Begin
•YoumustenablesessionservicesinCiscoISEandinstalltheadvancedlicensepackagetoserveallthe
posturerequestsreceivedfromtheclients.
•Ifyouhavemorethanonenodethatisregisteredinadistributeddeployment,allthenodesthatyou
haveregisteredappearintheDeploymentNodespage,apartfromtheprimarynode.Youcanconfigure...

Posture Administration Settings
YoucangloballyconfiguretheAdminportalforpostureservices.Youcandownloadupdatesautomatically
totheCiscoISEserverthroughthewebfromCisco.YoucanalsoupdateCiscoISEmanuallyofflinelater.
Inaddition,havinganagentlikeAnyConnect,theNACAgent,ortheWebAgentinstalledontheclients
providespostureassessmentandremediationservicestoclients.Theclientagentperiodicallyupdatesthe
compliancestatusofclientstoCiscoISE.Afterloginandsuccessfulrequirementassessmentforposture,the...

failureofposture.Whensuccessfullypostured,CiscoISEallowsclientstotransitionfromunknownto
compliantmodewithinthetimespecifiedinthenetworktransitiondelaytimer.Uponfailureofposture,Cisco
ISEallowsclientstotransitionfromunknowntononcompliantmodewithinthetimespecifiedinthetimer.
Procedure
Step 1ChooseAdministration>System>Settings>Posture>GeneralSettings.
Step 2Enteratimevalueinseconds,intheNetworkTransitionDelayfield.
Thedefaultvalueis3seconds.Thevalidrangeis2to30seconds.
Step 3ClickSave.
Set Login Success...

Procedure
Step 1ChooseAdministration>System>Settings>Posture>GeneralSettings.
Step 2FromtheDefaultPostureStatusdrop-downlist,choosetheoptionasCompliantorNoncompliant.
Step 3ClickSave.
Posture Lease
YoucanconfigureCiscoISEtoperformpostureassessmenteverytimeauserlogsintoyournetworkor
performpostureassessmentinspecifiedintervals.Thevalidrangeis1to365days.
ThisconfigurationappliesonlyforthosewhouseAnyConnectagentforpostureassessment.
Periodic Reassessments...

•IfaPRAconfigurationalreadyexistswithauseridentitygroup“Any”,youcannotcreateotherPRA
configurationsunlessyouperformoneofthefollowing:
◦UpdatetheexistingPRAconfigurationwiththeAnyuseridentitygrouptoreflectauseridentity
groupotherthanAny.
◦DeletetheexistingPRAconfigurationwithauseridentitygroup“Any”.
Procedure
Step 1ChooseAdministration>System>Settings>Posture>Reassessments.
Step 2ClickAdd.
Step 3ModifythevaluesintheNewReassessmentConfigurationpagetocreateanewPRA.
Step...

Step 4ModifythevaluesonthePostureUpdatespage.
Step 5ClickUpdateNowtodownloadupdatesfromCisco.
Step 6ClickOKtocontinuewithothertasksonCiscoISE.
Onceupdated,thePostureUpdatespagedisplaysthecurrentCiscoupdatesversioninformationasaverification
ofanupdateunderUpdateInformationsectioninthePostureUpdatespage.
Download Posture Updates Automatically
Afteraninitialupdate,youcanconfigureCiscoISEtocheckfortheupdatesanddownloadthemautomatically.
Before You Begin...

Procedure
Step 1ChooseAdministration>System>Settings>Posture>AcceptableUsePolicy.
Step 2ClickAdd.
Step 3ModifythevaluesintheNewAcceptableUsePolicyConfigurationpage.
Step 4ClickSubmit.
Posture Conditions
Apostureconditioncanbeanyoneofthefollowingsimpleconditions:afile,aregistry,anapplication,a
service,oradictionarycondition.Oneormoreconditionsfromthesesimpleconditionsformacompound
condition,whichcanbeassociatedtoaposturerequirement....