User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 14 Network Access Profiles
Table 14-3 Posture Validation for NAC Layer 3 IP Sample
Section Object Value
Internal
posture policy
NAC L2 IP
OL-14386-02
NAC-SAMPLE-CTA-
POLICY
Condition System Posture
Token
Rule 1 Cisco:PA:PA-Name
contains CTA and
Cisco:PA:PA-Version >=1.0
Cisco:PA:Healthy N/A
Default N/A Cisco:PA:Quarantine N/A
User Guide for Cisco Secure Access Control Server 4.2
Using Profile Templates
Notification
String
Table 14-4 describes the Shared Profile Components in the NAC Layer 3 IP Sample Profile Template.
Table 14-4 Shared Profile Components for NAC Layer 3 IP Sample
Type Object Value
RADIUS NAC-SAMPLE-HEALTHY-L3-RAC [027]Session-Timeout = 36,000
Authorization
Components
[26/9/1]cisc-av-pair status-query-timeout=300
[029] Termination-Action RADIUS-Request (1)
NAC-SAMPLE-QUARANTINE-L3-RA [027]Session-Timeout = 3,600
C
[26/9/1]cisc-av-pair status-query-timeout=30
Downloadable
IP ACLs
[029] Termination-Action RADIUS-Request (1)
NAC-SAMPLE-HEALTHY-ACL ACL Content
Name
Content NAF
NAC-SAMPLE-QUARANTINE-ACL L3-EXAMPLE permit ip any
any
(All-AAA-Clients)
Before you use this template, ensure that you have checked the Enable EAP Configuration > Allow
Posture Validation option in the Global Authentication Setup page.
You can use NAC Layer 2 IP on an access port on an edge switch to which an endpoint system or client
is connected. The device (host or client) can be a PC, a workstation, or a server that is connected to the
switch access port through a direct connection, an IP phone, a hub, or a wireless access point.
When NAC Layer 2 IP is enabled, UDP only works with IPv4 traffic. The switch checks the antivirus
condition of the endpoint devices or clients and enforces access-control policies.
This template sets Advanced Filtering and Authentication properties with NAC-L2-IP Configuration
automatically.
ACS and AV Pairs
When you enable NAC Layer 2 IP validation, ACS provides NAC AAA services by using RADIUS. ACS
gets information about the antivirus credentials of the endpoint system and validates the antivirus
condition of the endpoint.
You can set these Attribute-Value (AV) pairs on ACS by using the RADIUS cisco-av-pair vendorspecific
attributes (VSAs).
14-11