User Guide for Cisco Secure Access Control Server - Stewing Home

Posture Validation Pages Reference
Table 13-13 External Posture Validation Audit Server Setup Options (continued)
Option Description
URL The URL of the audit server. Specify the HTTP or HTTPS protocol.
URLs must conform to the following format:
13-38
User Guide for Cisco Secure Access Control Server 4.2
[http[s]://]host[:port]/resource
Chapter 13 Posture Validation
where host is the hostname or IP address of the external server, port is the port
number used, and resource is the rest of the URL, as required by the external server.
The URL varies depending on the server vendor and configuration.
The audit server documentation contains specific format guidelines.
Username The username that the audit server requires.
Password The password that the audit server requires.
Timeout (sec) The number of seconds that ACS waits for a result from the audit server, including
domain name resolution. The Timeout value must be greater than zero (0).
Trusted Root CA A certification authority that is required if the URL of the audit server specifies the
HTTPS protocol. This option should match the certification authority that issued
the audit server certificate installed on the primary server.
Validate Certificate Common Name When checked (enabled), this option shows the host name within the URL for
purposes of comparison with the common name in the certificate. If the names do
not match, ACS closes the SSL connection, posture validation fails, and user access
is denied.
Audit Flow Settings
Use this Posture Token while Audit Interim posture token sent from ACS to the NAD while waiting for a result. ACS
Server does not yet have a posture uses the In Progress token before the Audit Server determines the actual posture of
validation result
the nonresponsive host.
Polling Intervals and Session-Timeout Either the timeout values that are sent by the audit server or that are set in the
authorization policy. ACS requires a polling interval if the configuration uses the
values that are set in the authorization policy. The authorization policy must
include the necessary RACs in order to assign specific timeout values in the final
resulting tokens. See Configuring an Authorization Rule, page 14-36.
Maximum amount of times the Audit
Server should be polled
Policy string to be sent to the Audit
Server
GAME Group Feedback
The maximum number of times that ACS will query the audit server for a result
(posture token). Range of 1–10 times.
The name of the policy, if the audit server supports named policy invocation.
Request Device Type from Audit Server Enables the audit policy configuration options. When enabled, the Audit feature
can request a device type from the audit server and then check the device type
against the device type that MAC authentication returns.
If this check box is not available, define an audit device type attribute for the
vendor in the internal ACS dictionary.
ACS for Windows: Use the CSUtil.exe command. See Posture-Validation
Attributes, page C-29 for information.
ACS SE: Use the NAC Attributes Management page in the web interface. See NAC
Attribute Management (ACS SE Only), page 8-44 for more information.
OL-14386-02