User Guide for Cisco Secure Access Control Server - Stewing Home

Configuring Policies
13-26
User Guide for Cisco Secure Access Control Server 4.2
Chapter 13 Posture Validation
Step 2 Click External Posture Validation Audit Setup.
The External Posture Validation Audit Server page appears.
Step 3 Click Add Server.
The External Posture Validation Audit Server Setup page appears.
Step 4 Type the Name that identifies the audit policy. See Table 13-13 on page 13-37 for complete information
on all options in this procedure.
Step 5 Type a Description of the audit policy.
Step 6 Select the appropriate options in the Which Groups and Hosts are Audited area. If necessary, identify
hosts by using IP and MAC addresses.
Step 7 Choose a Posture Token.
Step 8 Choose an Audit Server Vendor in the Use These Audit Servers area.
Step 9 Check the Primary Server Configuration option to configure a primary server.
Step 10 Provide the configuration information for the primary server.
If your audit vendor does not appear, you must define an audit APT for the vendor in the internal ACS
dictionary.
ACS for Windows: You use the CSUtil.exe command. For detailed instructions, see Posture-Validation
Attributes, page C-29.
ACS SE: You use the NAC Attributes Management page in the web interface. For detailed instructions,
see NAC Attribute Management (ACS SE Only), page 8-44.
Step 11 Check the Secondary Server Configuration option to configure a secondary server.
Step 12 Provide the configuration information for the secondary server.
Step 13 Choose a temporary posture token from the drop-down list in the Audit Flow Settings area.
Step 14 Choose a timeout option.
Step 15 Type a polling interval.
Step 16 Choose the Maximum amount of times the Audit Server should be polled.
Step 17 Type a Policy string to be sent to the Audit Server.
Step 18 Check the Request Device Type from Audit Server option in the Audit Policy area if you want to
cross-check the device types that the audit server and MAC authentication return.
If this check box is not available (greyed out), define an audit device type attribute for the vendor in the
internal ACS dictionary.
ACS for Windows: You use the CSUtil.exe command. See Posture-Validation Attributes, page C-29 for
information.
ACS SE: You use the NAC Attributes Management page in the web interface. See NAC Attribute
Management (ACS SE Only), page 8-44 for more information.
Step 19 Check the Assign This Group if Audit Server Did not Return a Device-Type option if you want to
configure a default destination group.
Step 20 Click Add to add a device-type feedback rule.
Step 21 Choose a device type.
Step 22 Choose the User Group that will be initially compared with the device type that MAC authentication
returned.
OL-14386-02