Aaa Down Policy; Nac Layer 2 Ip Validation - Cisco 7604 Configuration Manual

Understanding NAC

AAA Down Policy

The AAA down policy is a method of allowing a host to remain connected to the network if the AAA
server is not available. Typical deployments of NAC use Cisco Secure ACS to validate the client posture
and to pass policies back to the Network Access Device (NAD). If the AAA server cannot be reached
when the posture validation occurs, instead of rejecting the user (that is, not providing the access to the
network), an administrator can configure a default AAA down policy that can be applied to the host.
This policy is advantageous for the following reasons:
•
•
When the AAA server is down, the AAA down policy is applied only if there is no existing policy
Note
associated with the host. Typically, during revalidation when the AAA server goes down, the policies
being used for the host are retained.

NAC Layer 2 IP Validation

You can use NAC Layer 2 IP on an access port on an edge switch to which an endpoint system or client
is connected. The device (host or client) can be a PC, a workstation, or a server that is connected to the
switch access port through a direct connection, an IP phone, or a wireless access point, as shown in
Figure
When NAC Layer 2 IP is enabled, EAPoUDP only works with IPv4 traffic. The switch checks the
antivirus status of the endpoint devices or clients and enforces access control policies.
Figure 45-2 Network Using NAC Layer 2 IP
Clients running
the Cisco Trust Agent
These sections describe NAC Layer 2 IP validation:
•
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
45-4
While AAA is unavailable, the host will still have connectivity to the network, although it may be
restricted.
When the AAA server is again available, a user can be revalidated, and the user's policies can be
downloaded from the ACS.
45-2.
PC
Hub
Workstation
IP phone
IP
PC
software
Posture Validation, page 45-5
Chapter 45 Configuring Network Admission Control
PC
Cisco
Secure ACS
Switch
Network Authentication
Access Server (RADIUS)
Device
OL-4266-08