User Guide for Cisco Secure Access Control Server - Stewing Home

Using Profile Templates
Table 14-17 Shared Profile Components for Agentless Host for L3 Sample
Type Object Value
RADIUS
Authorization
Components
Downloadable
IP ACLs
Agentless Host for L2 and L3
14-20
User Guide for Cisco Secure Access Control Server 4.2
Chapter 14 Network Access Profiles
NAC-SAMPLE-TRANSITION-L3-RAC [027] Session-Timeout = 60
[029] Termination-Action RADIUS-Request (1)
A Session-Timeout can be overwritten if hinted by an audit
server
NAC-SAMPLE-HEALTHY-L3-RAC [027]Session-Timeout = 36,000
[029] Termination-Action RADIUS-Request (1)
NAC-SAMPLE-QUARANTINE-L3-RAC [027]Session-Timeout = 3,600
[029] Termination-Action RADIUS-Request (1)
ACL Content
Name
Content NAF
NAC-_SAMPLE-_TRANSITION-_ACL L3-EXAMPLE permit ip any
any
(All-AAA-Clients)
NAC-_SAMPLE-_HEALTHY-_ACL L3-EXAMPLE permit ip any
any
(All-AAA-Clients)
NAC_-SAMPLE-_QUARANTINE-_ACL L3-EXAMPLE permit ip any
any
(All-AAA-Clients)
This template is used for access requests from agentless hosts connected to an L2 Network Access
Device (NAD). ACS first admits the device to a quarantine network where it can receive an IP address.
Audit begins when the device has received an IP address. At this point, the audit is the same as an audit
for an L3 host. The NAD must be configured to learn the host's IP address ahead of time. ACS responds
to an initial Access-Request with a notification to the device to issue another request when it learns the
IP address. If the NAD does not learn the host's IP address, ACS invokes a failure condition and policy
flow falls over to Audit Fail-Open policy. The administrator can then choose to reject the user, or assign
a posture token and an optional user group.
Table 14-18 describes the Profile Sample in the Agentless Host for L2 and L3 Sample Profile Template.
Table 14-18 Agentless Host for L2 and L3 Sample Profile Template
Section Property Value
NAP Name User configurable
Description User configurable
OL-14386-02