STIGQter: STIG Summary: Cisco ISE NAC Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 13 Apr 2021:

For endpoints that require automated remediation, the Cisco ISE must be configured to redirect endpoints to a logically separate VLAN for remediation services.

DISA Rule

SV-242581r714053_rule

Vulnerability Number

V-242581

Group Title

SRG-NET-000015-NAC-000040

Rule Version

CSCO-NC-000070

Severity

CAT II

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure the "Posture NonCompliant" authorization policy so that the result that will assign the remediation VLAN.

1. Work Centers >> Network Access >> Policy Sets.
2. Choose ">" on the desired policy set.
3. Expand Authorization Policy.
4. Create an authorization policy for "Posture NonCompliant".
5. Assign the remediation VLAN result.

Check Contents

Verify that the authorization policies for "Posture NonCompliant" have a result that will assign the remediation VLAN.

1. Work Centers >> Network Access >> Policy Sets.
2. Choose ">" on the desired policy set.
3. Expand Authorization Policy.
4. Scan for Authorization policies with "Posture NonCompliant" condition.
5. Verify the result assigned to the authorization policy will assign the remediation VLAN.

If the result is the remediation VLAN, this is not a finding.

If posture is not mandated by the Information System Security Manager (ISSM), this is not a finding.

Vulnerability Number

V-242581

Documentable

False

Rule Version

CSCO-NC-000070

Severity Override Guidance

Verify that the authorization policies for "Posture NonCompliant" have a result that will assign the remediation VLAN.

1. Work Centers >> Network Access >> Policy Sets.
2. Choose ">" on the desired policy set.
3. Expand Authorization Policy.
4. Scan for Authorization policies with "Posture NonCompliant" condition.
5. Verify the result assigned to the authorization policy will assign the remediation VLAN.

If the result is the remediation VLAN, this is not a finding.

If posture is not mandated by the Information System Security Manager (ISSM), this is not a finding.

Check Content Reference

M

Target Key

5383

Comments