Cisco ASA 5505 - Manual (Page 1542)

70-2
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 70 Configuring Network Admission Control
Licensing Requirements
In a NAC Framework configuration involving the ASA, only a Cisco Trust Agent running on the client
can fulfill the role of posture agent, and only a Cisco Access Control Server (ACS) can fulfill the role of
posture validation server. The ACS uses dynamic ACLs to determine the access policy for each client.
As a RADIUS server, the ACS can authenticate the login credentials required to establish a tunnel, in
addition to fulfilling its role as posture validation server.
Note Only a NAC Framework policy configured on the ASA supports the use of an audit server.
In its role as posture validation server, the ACS uses access control lists. If posture validation succeeds
and the ACS specifies a redirect URL as part of the access policy it sends to the ASA, the ASA redirects
all HTTP and HTTPS requests from the remote host to the redirect URL. Once the posture validation
server uploads an access policy to the ASA, all of the associated traffic must pass both the Security
Appliance and the ACS (or vice versa) to reach its destination.
The establishment of a tunnel between an IPsec or WebVPN client and the ASA triggers posture
validation if a NAC Framework policy is assigned to the group policy. The NAC Framework policy can,
however, identify operating systems that are exempt from posture validation and specify an optional
ACL to filter such traffic.
Licensing Requirements
The following table shows the licensing requirements for this feature:
Note This feature is not available on No Payload Encryption models.
Model License Requirement 1,2
ASA 5505 AnyConnect Premium license:
• Base License or Security Plus license: 2 sessions.
• Optional permanent or time-based licenses: 10 or 25 sessions.
• Shared licenses are not supported. 3
ASA 5510 AnyConnect Premium license:
• Base and Security Plus License: 2 sessions.
• Optional permanent or time-based licenses: 10, 25, 50, 100, or 250 sessions.
• Optional Shared licenses 3 : Participant or Server. For the Server license, 500-50,000 in increments
of 500 and 50,000-545,000 in increments of 1000.
ASA 5520 AnyConnect Premium license:
• Base License: 2 sessions.
• Optional permanent or time-based licenses: 10, 25, 50, 100, 250, 500, or 750 sessions.
• Optional Shared licenses 3 : Participant or Server. For the Server license, 500-50,000 in increments
of 500 and 50,000-545,000 in increments of 1000.