Configuring Network Admission Control Parameters - Cisco PIX 500 Series Configuration Manual

Group Policies

Configuring Network Admission Control Parameters

The group-policy NAC commands in this section all have default values. Unless you have a good reason
for changing them, accept the default values for these parameters.
The security appliance uses Extensible Authentication Protocol (EAP) over UDP (EAPoUDP)
messaging to validate the posture of remote hosts. Posture validation involves the checking of a remote
host for compliancy with safety requirements before the assignment of a network access policy. An
Access Control Server must be configured for Network Admission Control before you configure NAC
on the security appliance.
The Access Control Server downloads the posture token, an informational text string configurable on
the ACS, to the security appliance to aid in system monitoring, reporting, debugging, and logging. A
typical posture token is Healthy, Checkup, Quarantine, Infected, or Unknown. Following posture
validation or clientless authentication, the ACS downloads the access policy for the session to the
security appliance.
The following parameters let you configure Network Admission Control settings for the default group
policy or an alternative group policy.
(Optional) Configure the status query timer period. The security appliance starts the status query timer
Step 1
after each successful posture validation and status query response. The expiration of this timer triggers
a query for changes in the host posture, referred to as a status query. Enter the number of seconds in the
range 30 through 1800. The default setting is 300.
To specify the interval between each successful posture validation in a Network Admission Control
session and the next query for changes in the host posture, use the nac-sq-period command in
group-policy configuration mode:
hostname(config-group-policy)# nac-sq-period seconds
hostname(config-group-policy)#
To inherit the value of the status query timer from the default group policy, access the alternative group
policy from which to inherit it, then use the no form of this command:
hostname(config-group-policy)# no nac-sq-period [ seconds ]
hostname(config-group-policy)#
The following example changes the value of the status query timer to 1800 seconds:
hostname(config-group-policy)# nac-sq-period 1800
hostname(config-group-policy)
The following example inherits the value of the status query timer from the default group policy:
hostname(config-group-policy)# no nac-sq-period
hostname(config-group-policy)#
(Optional) Configure the NAC revalidation period. The security appliance starts the revalidation timer
Step 2
after each successful posture validation. The expiration of this timer triggers the next unconditional
posture validation. The security appliance maintains posture validation during revalidation. The default
group policy becomes effective if the Access Control Server is unavailable during posture validation or
revalidation. Enter the interval in seconds between each successful posture validation. The range is 300
through 86400. The default setting is 36000.
To specify the interval between each successful posture validation in a Network Admission Control
session, use the nac-reval-period command in group-policy configuration mode:
hostname(config-group-policy)# nac-reval-period seconds
hostname(config-group-policy)#
Cisco Security Appliance Command Line Configuration Guide
30-54
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
OL-12172-03