User Guide for Cisco Secure Access Control Server - Stewing Home

Configuring Policies for Profiles
14-32
A warning message appears.
Step 5 Click OK.
Setting a Posture-Validation Policy to Process Statements of Health
User Guide for Cisco Secure Access Control Server 4.2
Chapter 14 Network Access Profiles
A posture-validation policy can have one or more posture-validation rules. When ACS uses a
posture-validation policy to evaluate a posture-validation request, the first match is implemented. The
chosen rules determine which internal and external policies will be activated for the request.
You can configure posture-validation policies that might be associated with a rule in Internal or External
Posture Validation Setup, as applicable.
You can also set up a SoH posture validation rule.
Before you begin:
Ensure that you have:
Checked the Allow Posture Validation option on the Authentication Settings page (see
Authentication for profile_name Page, page 14-46).
Set posture validation settings (see Configuring NAC in ACS, page 13-13 for details).
Checked the Microsoft Network Access Protection Settings check box on the Advanced Options
page.
To add an SoH posture validation rule to a profile:
Step 1 Choose Network Access Profiles.
Step 2 Choose Posture Validation for the selected profile.
The Posture Validation page appears.
Step 3 Click Add Rule under the Statement of Health Posture Validation Rules table.
The Statement of Health Posture Validation Rule page appears.
Step 4 Enter a Name for the rule.
Step 5 Configure the Endpoint Location.
Step 6 Choose which External Posture Validation Servers are to be activated.
Step 7 To configure ACS to reject a user if the Network Policy Server (NPS) is unable to finalize the Statement
of Health for the client, check the Reject User check box.
Note The Reject User option works only if the NPS Server is unable to finalize the Statement of
Health for the client.
Step 8 If you want to specify a token that will be used if the NPS Server is unable to finalize the Statement of
Health for the client:
Uncheck the Reject User check box.
From the drop-down list in the Failure Posture Token field, choose a token type to assign.
OL-14386-02