Cisco Systems ASA5515K9, ASA 5500 Assigning a NAC Policy to a Group Policy, Changing Global NAC Framework Settings

70-13

Cisco ASA 5500 Series Configuration Guide using the CLI

Chapter70 Configuring Network Admission Control

Assigning a NAC Policy to a Group Policy

Assigning a NAC Policy to a Group Policy

Upon completion of each tunnel setup, the ASA applies the NAC policy, if it is assigned to the group

policy, to the session. By default, the nac-settings command is not present in the configuration of each

group policy. The ASA automatically enables NAC for a group policy when you assign a NAC policy to

it.

Detailed Steps

Changing Global NAC Framework Settings

The ASA provides default settings for a NAC Framework configuration. Use the instructions in this

section to adjust these settings for adherence to the policies in force in your network.

NAC Framework support for clientless authentication is configurable. It applies to hosts that do not have

a Cisco Trust Agent to fulfill the role of posture agent. The ASA applies the default access policy, sends

the EAP over UDP request for posture validation, and the request times out. If the ASA is not configured

to request a policy for clientless hosts from the Access Control Server, it retains the default access policy

already in use for the clientless host. If the ASA is configured to request a policy for clientless hosts

from the Access Control Server, it does so and the Access Control Server downloads the access policy

to be enforced by the ASA.

Command Purpose

Step1 group-policy Switches to group-policy configuration mode.

Step2 nac-settings { value nac-policy-name | none }

Example:

hostname(config-group-policy)# nac-settings value

framework1

hostname(config-group-policy)

Assigns a NAC policy to a group policy.

•nac-settings none removes the

nac-policy-name from the group policy and

disables the use of a NAC policy for this group

policy. The group policy does not inherit the

nac-settings value from the default group policy.

•nac-settings value assigns the NAC policy

you name to the group policy.

Assigns the NAC policy named framework1 to the

group policy.

Step3 (Optional)

[no] nac-settings { value nac-policy-name | none }

Removes the nac-policy-name from the group

policy. The group policy inherits the nac-settings

value from the default group policy.

Step4 (Optional)

show running-config nac-policy

Displays the name and configuration of each NAC

policy