Cisco Cisco AnyConnect Secure Mobility Client v2.x Troubleshooting Guide
AnyConnect Version 4.0 and NAC Posture Agent
Does Not Pop Up on ISE Troubleshoot Guide
Does Not Pop Up on ISE Troubleshoot Guide
Document ID: 118724
Contributed by Nicolas Darchis, Cisco TAC Engineer.
Mar 20, 2015
Mar 20, 2015
Contents
Introduction
Prerequisites
Requirements
Components used
Troubleshooting Methodology
What makes the agent pop up?
Possible Causes
Redirection Does Not Happen
Attributes Are Not Installed on the Network Device
Attributes Are in Place But Network Device Does Not Redirect
Interfering Downloadable Access−list (DACL)
Bad NAC Agent Version
HTTP Web Proxy Is in Use by Clients
Discovery Hosts Are Configured in the NAC Agent
NAC Agent Does Not Pop Up Sometimes
Reverse Problem: Agent Pops Up Repeatedly
Related Information
Prerequisites
Requirements
Components used
Troubleshooting Methodology
What makes the agent pop up?
Possible Causes
Redirection Does Not Happen
Attributes Are Not Installed on the Network Device
Attributes Are in Place But Network Device Does Not Redirect
Interfering Downloadable Access−list (DACL)
Bad NAC Agent Version
HTTP Web Proxy Is in Use by Clients
Discovery Hosts Are Configured in the NAC Agent
NAC Agent Does Not Pop Up Sometimes
Reverse Problem: Agent Pops Up Repeatedly
Related Information
Introduction
Identity Services Engine (ISE) provides posturing capabilities that require the use of the Network Admission
Control (NAC) agent (for Microsoft Windows, Macintosh, or via webagent) or AnyConnect Version 4.0. The
AnyConnect Version 4.0 ISE posture module works exactly like the NAC agent and is therefore referred to as
the NAC agent in this document. The most common symptom of posture failure for a client is that the NAC
agent does not pop up since a working scenario always causes the NAC agent window to pop up and analyze
your PC. This document helps you narrow down the many causes that can lead the posture to fail, which
means the NAC agent does not pop up. It is not meant to be exhaustive because the NAC agent logs can only
be decoded by the Cisco Technical Assistance Center (TAC) and the possible root causes are numerous;
however it aims to clarify the situation and pinpoint the problem further than simply "the agent does not pop
up with the posture analysis" and will probably help you solve the most common causes.
Control (NAC) agent (for Microsoft Windows, Macintosh, or via webagent) or AnyConnect Version 4.0. The
AnyConnect Version 4.0 ISE posture module works exactly like the NAC agent and is therefore referred to as
the NAC agent in this document. The most common symptom of posture failure for a client is that the NAC
agent does not pop up since a working scenario always causes the NAC agent window to pop up and analyze
your PC. This document helps you narrow down the many causes that can lead the posture to fail, which
means the NAC agent does not pop up. It is not meant to be exhaustive because the NAC agent logs can only
be decoded by the Cisco Technical Assistance Center (TAC) and the possible root causes are numerous;
however it aims to clarify the situation and pinpoint the problem further than simply "the agent does not pop
up with the posture analysis" and will probably help you solve the most common causes.
Prerequisites
Requirements
The scenarios, symptoms, and steps listed in this document are written for you to troubleshoot issues after the
initial setup is already completed. For the initial configuration, refer to Posture Services on the Cisco ISE
Configuration Guide on Cisco.com.
initial setup is already completed. For the initial configuration, refer to Posture Services on the Cisco ISE
Configuration Guide on Cisco.com.