Cisco ASA 5505 - Manual (Page 1553)

70-13
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 70 Configuring Network Admission Control
Assigning a NAC Policy to a Group Policy
Assigning a NAC Policy to a Group Policy
Upon completion of each tunnel setup, the ASA applies the NAC policy, if it is assigned to the group
policy, to the session. By default, the
nac-settings command is not present in the configuration of each
group policy. The ASA automatically enables NAC for a group policy when you assign a NAC policy to
it.
Detailed Steps
Changing Global NAC Framework Settings
The ASA provides default settings for a NAC Framework configuration. Use the instructions in this
section to adjust these settings for adherence to the policies in force in your network.
Changing Clientless Authentication Settings
NAC Framework support for clientless authentication is configurable. It applies to hosts that do not have
a Cisco Trust Agent to fulfill the role of posture agent. The ASA applies the default access policy, sends
the EAP over UDP request for posture validation, and the request times out. If the ASA is not configured
to request a policy for clientless hosts from the Access Control Server, it retains the default access policy
already in use for the clientless host. If the ASA is configured to request a policy for clientless hosts
from the Access Control Server, it does so and the Access Control Server downloads the access policy
to be enforced by the ASA.
Command Purpose
Step 1 group-policy Switches to group-policy configuration mode.
Step 2 nac-settings { value nac-policy-name | none }
Example:
hostname(config-group-policy)# nac-settings value
framework1
hostname(config-group-policy)
Assigns a NAC policy to a group policy.
• nac-settings none removes the
nac-policy-name from the group policy and
disables the use of a NAC policy for this group
policy. The group policy does not inherit the
nac-settings value from the default group policy.
• nac-settings value assigns the NAC policy
you name to the group policy.
Assigns the NAC policy named framework1 to the
group policy.
Step 3 (Optional)
[
no
]
nac-settings
{ value nac-policy-name | none }
Removes the nac-policy-name from the group
policy. The group policy inherits the nac-settings
value from the default group policy.
Step 4 (Optional)
show running-config nac-policy
Displays the name and configuration of each NAC
policy