We have configured NAC (CAM+CAS) in-band configuration with ASA Client/server VPN.

The ASA uses SmartCard authentication to logon users onto VPN. The SC logon works with VPN, however the CAM is not pushing the CTA to the client.

This laptop had CTA client before, but I wanted to make sure that the CTA push works, so I uninstalled it. Now it doesn't install the CTA.

Any thoughts??