Domain Posture Check Failure

1

I'm running windows Edge Client 2.9.5 to access OpenZiti Overlay Network, it works well.

I try to create a Posture Check OS System Check, it works well.
I try to create a Posture Check with Domain check, BUT it doesn't work.

  1. This is my posture check config

https://controller.poc.net:1280/edge/management/v1/posture-checks/54qc5ku1XrCfKb1QNoy1cn
{
"name": "windows-domain-check",
"typeId": "DOMAIN",
"tags": {},
"domains": [
"apollo.workspace.poc.net"
]
}

  1. This is my dial policy
    {
    "name": "700644-legacy-sftp-dial",
    "appData": "",
    "serviceRoles": [
    "@3oUr7xpAPWVutdqWYjQVR6"
    ],
    "identityRoles": [
    "#700644-legacy-sftp-dial"
    ],
    "postureCheckRoles": [
    "@54qc5ku1XrCfKb1QNoy1cn"
    ],
    "semantic": "AnyOf",
    "type": "Dial",
    "tags": {}
    }

  2. The identity used to run the edge client has below env info
    "envInfo": {
    "arch": "x86_64",
    "domain": "apollo.workspace.poc.net",
    "hostname": "1bd4c6da001",
    "os": "MINGW32_NT-10.0",
    "osRelease": "10.0.26100",
    "osVersion": "Windows 11 Enterprise"
    },

  3. The error log from the edge client shows
    ERROR ziti-sdk:ziti_ctrl.c:504 ctrl_body_cb() ctrl[https://controller.poc.net:1280/\] API request[/sessions] failed code[INVALID_POSTURE] message[Posture response data is missing or wrong]
    WARN ziti-sdk:connect.c:476 connect_get_net_session_cb() conn2.80/z3XPalVQ/Connecting failed to get 'Dial' session for service[700644-legacy-sftp]: INVALID_POSTURE(Posture response data is missing or wrong)
    ERROR tunnel-cbs:ziti_tunnel_cbs.c:122 on_ziti_connect() ziti dial failed: failed posture check

Please advise what could be the issue here. The identity envinfo shows domain matchs Posture check domain, why here posture check was failed?

2

Hi experts,

Anyone can provide some advices here, throw some hints here. much appreciated!