User Guide for Cisco Secure Access Control Server - Stewing Home

Configuring Policies for Profiles
14-34
User Guide for Cisco Secure Access Control Server 4.2
Chapter 14 Network Access Profiles
A posture-validation policy can have 0-n ordered posture rules.
The posture validation selected is the first that match of the mandatory credential types.
The posture token that will return is the worst assessment that returned from the selected local policies
and external posture servers.
If the client is an agentless host, the selected Audit server will audit the client.
To configure a posture validation policy for a NAH:
Step 1 Choose Network Access Profiles.
Step 2 Choose Posture Validation for the selected profile.
The Posture Validation Page appears.
Step 3 Choose Select Audit.
The Select External Posture Validation Audit for profile_name Page appears.
Step 4 Choose the relevant audit server. Select Do Not Use Audit Server if you do not want to use an audit
server for posture validation.
Step 5 To enable fail open:
a. Check the Do Not reject when Audit failed check box.
b. Choose the posture token to be used in the event of a failure.
c. Enter a value for session-timeout for the audit server.
d. To assign a user group, check the Assign a User Group check box and choose a group from the
drop-down list.
Step 6 Click Submit.
Step 7 Click Apply and Restart for your changes to take effect.
Authorization Policy Configuration for NAPs
About Authorization Rules
These topics provide information on configuring authorization rules:
About Authorization Rules, page 14-34
Configuring an Authorization Rule, page 14-36
Configuring a Default Authorization Rule, page 14-37
Ordering the Authorization Rules, page 14-37
Deleting an Authorization Rule, page 14-38
Troubleshooting Profiles, page 14-38
Authorization policies comprise rules that are applied to a NAP. Authorization policies are used for
authorizing an authenticated user. Authorization rules can be based on group membership, posture
validation, or both. Authorization actions are built from RACs and ACLs.
OL-14386-02