22-23
Cisco Router and Security Device Manager Version 2.2 User’s Guide
OL-4015-08
Chapter22 Network Admission Control
Create NAC Tab
Welcome
The NAC wizard enables you to do the following:
•Configure RADIUS parameters—Admission control polices ar e configured
on RADIUS servers that the router contacts when a network host attempts
access to the network. You can specify information for multiple RADIUS
servers.
•Select the interfaces on which NAC is to be enabled—Hosts attempting
access to the network through these interfaces go through the NAC process.
•Configure a NAC exception list—Hosts such as printers, IP phones, and hosts
without NAC posture agents installed may need to bypass the NAC process.
Hosts with static IP addresses and other devices can be identified in an
exception list, and be handled using an associated exceptionpolicy. Hosts
needing to be on the exception list can also be identified by their MAC
address.
•Configure an exception policy—This policy contains the IP addresses that
hosts on the exception list are allowed to connect to, or it can specify an URL
to redirect hosts to that can contain instructions for obtaining the latest virus
definition files.
•Configure a agentless host policy—If you want to use a policy residing on an
ACS server to handle hosts without an installed posture agent, you can do so.
When the ACS server receives such a packet, it responds by sending the
agentless host policy.
RADIUS Server
NAC admission control policies are configured and stored in a policy database
residing on RADIUS servers running ACS version 3.3. The router must validate
the credentials of network hosts by communicating with the RADIUS server.
Provide the information the router needs to contact the RADIUS servers to use in
this window. Each RADIUS server that you specify must have Cisco Access
Control Server (ACS) software version 3.3 installed and configured.
You can add information for multiple RADIUS servers in one visit to this screen,
so long as they are all accessed from the same router interface.