User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 13 Posture Validation
Creating an Internal Policy
OL-14386-02
Editing a Policy, page 13-19
Deleting a Policy or Rule, page 13-21
User Guide for Cisco Secure Access Control Server 4.2
Configuring Policies
Use internal posture validation to write your own policies for access in your network. After you have
created policies, you can then profile rules to use these policies.
You can select internal policies for more than one profile. To add the policy to a profile, use the Network
Access Profiles page.
For descriptions of the options available on the Internal Posture Validation Setup page, see Configuring
Policies, page 13-15.
For details on how to set up your third-party component policies, see the related documentation on the
Go NAC website on Cisco.com. For information on adding internal policies to your profiles, see
Posture-Validation Policy Configuration for NAPs, page 14-29.
Once you have set up at least one policy, you can use the clone rule option to save time by copying a
policy and customizing it. For details on how to use cloning, see Cloning a Policy or Policy Rule,
page 13-20.
To create your internal posture validation policy:
Step 1 Access the Internal Policy Validation Setup page:
a. In the navigation bar, click Posture Validation.
b. Click Internal Posture Validation Setup.
ACS displays a list of posture validation policies, if available.
c. Click Add Policy.
Step 2 In the Name box, type a descriptive name for the policy.
Step 3 In the Description box, type a useful description of the policy.
Step 4 Click Submit.
Step 5 Click Add Rule.
Step 6 For each condition set that you want to add to the rule:
a. Select an attribute. For more information about attribute types, see Posture Validation Attribute Data
Types, page 13-6.
b. Select an entity (only available for extended attributes).
c. Select an operator.
d. Type a value.
e. Click Enter and then Submit.
For example, if you create a policy for the CSA, you might create the following condition sets:
Cisco:PA:PA-Version >= 2.0.0.0 AND Cisco:PA:Machine-Posture-State = 1 with a Posture
token=Healthy.
Cisco:PA:PA-Version >= 2.0.0.0 AND Cisco:PA:Machine-Posture-State = 2 with a Posture
Token=Transition.
Match OR inside Condition and AND between Condition Sets to allow ACS to choose between
tokens.
13-17