CHAPT ER
70-1
Cisco ASA 5500 Series Configuration Guide using the CLI
70
Configuring Network Admission Control
This chapter includes the following sections:
•Information about Network Admission Control, page 70-1
•Licensing Requirements, page70-2
•Prerequisites for NAC, page70-4
•Guidelines and Limitations, page70-4
•Viewing the NAC Policies on the Security Appliance, page70-5
•Adding, Accessing, or Removing a NAC Policy, page70-7
•Configuring a NAC Policy, page70-8
•Assigning a NAC Policy to a Group Policy, page70-13
•Changing Global NAC Framework Settings, page70-13

Information about Network Admission Control

Network Admission Control protects the enterprise network from intrusion and infection from worms,
viruses, and rogue applications by performing endpoint compliancy and vulnerability checks as a
condition for production access to the network. We refer to these checks as posturevalidation. You c an
configure posture validation to ensure that the anti-virus files, personal firewall rules, or intrusion
protection software on a host with an IPsec or WebVPN session are up-to-date before providing access
to vulnerable hosts on the intranet. Posture validation can include the verification that the applications
running on the remote hosts are updated with the latest patches. NAC occurs only after user
authentication and the setup of the tunnel. NAC is especially useful for protecting the enterprise network
from hosts that are not subject to automatic network policy enforcement, such as home PCs.
The establishment of a tunnel between the endpoint and the ASA triggers posture validation.
You can configure the ASA to pass the IP address of the client to an optional audit server if the client
does not respond to a posture validation request. The audit server, such as a Trend server, uses the host
IP address to challenge the host directly to assess its health. For example, it may challenge the host to
determine whether its virus checking software is active and up-to-date. After the audit server completes
its interaction with the remote host, it passes a token to the posture validation server, indicating the
health of the remote host.
Following successful posture validation or the reception of a token indicating the remote host is healthy,
the posture validation server sends a network access policy to the ASA for application to the traffic on
the tunnel.