Cisco ASA 5505 Configuration Manual page 1305

Chapter 63 Configuring IKE, Load Balancing, and NAC
To enable Clientless SSL VPN load balancing using FQDNs rather than IP addresses, perform the
following configuration steps:
Enable the use of FQDNs for Load Balancing by checking the Send FQDN to client... checkbox.
Step 1
Add an entry for each of your adaptive security appliance outside interfaces into your DNS server, if
Step 2
such entries are not already present. Each adaptive security appliance outside IP address should have a
DNS entry associated with it for lookups. These DNS entries must also be enabled for Reverse Lookup.
Enable DNS lookups on your adaptive security appliance on the dialog box Configuration > Device
Step 3
Management > DNS > DNS Client for whichever interface has a route to your DNS server.
Define your DNS server IP address on the adaptive security appliance. To do this, click Add on this
Step 4
dialog box. This opens the Add DNS Server Group dialog box. Enter the IP address of the DNS server
you want to add; for example,
Click OK and Apply.
Step 5
Modes
The following table shows the modes in which this feature is available:
Firewall Mode
Routed
•
Setting Global NAC Parameters
The adaptive security appliance uses Extensible Authentication Protocol (EAP) over UDP (EAPoUDP)
messaging to validate the posture of remote hosts. Posture validation involves checking a remote host
for compliancy with safety requirements before the assignment of a network access policy. An Access
Control Server must be configured for Network Admission Control before you configure NAC on the
adaptive security appliance.
Fields
The NAC pane lets you set attributes that apply to all NAC communications. The following global
attributes at the top of the pane apply to EAPoUDP messaging between the adaptive security appliance
and remote hosts:
•
•
OL-20339-01
Security Context
Transparent Single
— •
Port—Port number for EAP over UDP communication with the Cisco Trust Agent (CTA) on the
host. This number must match the port number configured on the CTA. Enter a value in the range
1024 to 65535. The default setting is 21862.
Retry if no response—Number of times the adaptive security appliance resends an EAP over UDP
message. This attribute limits the number of consecutive retries sent in response to Rechallenge
Interval expirations. The setting is in seconds. Enter a value in the range 1 to 3. The default setting
is 3.
(IP address of your DNS server).
192.168.1.1
Multiple
Context System
— —
Cisco ASA 5500 Series Configuration Guide using ASDM
Setting Global NAC Parameters
63-25