Cisco ASA 5505 - Manual (Page 1549)

70-9
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 70 Configuring Network Admission Control
Configuring a NAC Policy
Detailed Steps
Setting the Query-for-Posture-Changes Timer
After each successful posture validation, the ASA starts a status query timer. The expiration of this timer
triggers a query to the remote host for changes in posture since the last posture validation. A response
indicating no change resets the status query timer. A response indicating a change in posture triggers an
unconditional posture revalidation. The ASA maintains the current access policy during revalidation.
By default, the interval between each successful posture validation and the status query, and each
subsequent status query, is 300 seconds (5 minutes). Follow these steps to change the status query
interval:
Command Purpose
Step 1 aaa-server host Names the Access Control Server group even if the
group contains only one server.
Step 2 (Optional)
show running-config aaa-server
Example:
hostname(config)# show running-config aaa-server
aaa-server acs-group1 protocol radius
aaa-server acs-group1 (outside) host 192.168.22.44
key secret
radius-common-pw secret
hostname(config)#
Displays the AAA server configuration.
Step 3 nac-policy-nac-framework Switches to nac-policy-nac-framework
configuration mode.
Step 4 authentication-server-group server-group
Example:
hostname(config-nac-policy-nac-framework)#
authentication-server-group acs-group1
hostname(config-nac-policy-nac-framework)
Specifies the group used for NAC posture validation.
server-group must match the server-tag variable
specified in the aaa-server host command. It is
optional if you are using the no version of the
command.
Specifies acs-group1 as the authentication server
group used for NAC posture validation.
Step 5 (Optional)
[no] authentication-server-group server-group
Removes the command from the NAC policy.