User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 13 Posture Validation
Table 13-12 Add/Edit External Posture Validation Server Page (continued)
OL-14386-02
Posture Validation Pages Reference
Option Description
URL Specifies the HTTP or HTTPS URL for the server. The format for URLs is:
[http[s]://]host[:port]/resource
where host is the hostname or IP address of the NAC server, port is the port number used,
and resource is the rest of the URL, as required by the NAC server itself. The URL varies
depending on the server vendor and configuration. For the URL that your NAC server
requires, refer to your NAC server documentation.
The default protocol is HTTP. URLs beginning with the hostname are assumed to be using
HTTP. To use HTTPS, you must specify the URL beginning with https:// and import a
self-generated CA certificate into ACS for this policy server. See ACS Certificate Setup,
page 9-22.
If the port is omitted, the default port is used. The default port for HTTP is port 80. The
default port for HTTPS is port 443.
If the NAC server hostname is antivirus1, which uses port 8080 to respond to HTTP
requests for the service provided policy.asp, a script kept in a web directory called cnac,
valid URLs would be:
http://antivirus1:8080/cnac/policy.asp
antivirus1:8080/cnac/policy.asp
If the same server used the default HTTP port, valid URLs would be:
http://antivirus1/cnac/policy.asp
http://antivirus1:80/cnac/policy.asp
antivirus1/cnac/policy.asp
antivirus1:80/cnac/policy.asp
If the same server used HTTPS on the default port, valid URLs would be:
https://antivirus1/cnac/policy.asp
https://antivirus1:443/cnac/policy.asp
Username Specifies the username required for access to the server. The server ignores the values in
the Username and Password fields if the server is not password protected.
Password Specifies the password required for access to the server. The server ignores the values in
the Username and Password fields if the server is not password protected.
Timeout (Sec) The number of seconds that ACS waits for a result from the external server, including
domain name resolution. The Timeout value must be greater than zero (0). The default is
10.
ACS forwards requests to the secondary server (if configured) when the primary server
times out. If no secondary server is configured or if a request to the secondary server also
times out, ACS cannot apply the external policy and therefore rejects the posture
validation request.
For each posture validation request, ACS always tries the primary server first, regardless
of whether previous requests timed out.
User Guide for Cisco Secure Access Control Server 4.2
13-35