Cisco ASA Series Cli Configuration Manual page 1769

Chapter 1 Configuring Network Admission Control
Detailed Steps
Command
Step 1
aaa-server host
Step 2
(Optional)
show running-config aaa-server
Example:
hostname(config)# show running-config aaa-server
aaa-server acs-group1 protocol radius
aaa-server acs-group1 (outside) host 192.168.22.44
key secret
radius-common-pw secret
hostname(config)#
Step 3
nac-policy-nac-framework
Step 4
authentication-server-group server-group
Example:
hostname(config-nac-policy-nac-framework)#
authentication-server-group acs-group1
hostname(config-nac-policy-nac-framework)
Step 5
(Optional)
[no] authentication-server-group server-group
Setting the Query-for-Posture-Changes Timer
After each successful posture validation, the ASA starts a status query timer. The expiration of this timer
triggers a query to the remote host for changes in posture since the last posture validation. A response
indicating no change resets the status query timer. A response indicating a change in posture triggers an
unconditional posture revalidation. The ASA maintains the current access policy during revalidation.
By default, the interval between each successful posture validation and the status query, and each
subsequent status query, is 300 seconds (5 minutes). Follow these steps to change the status query
interval:
Purpose
Names the Access Control Server group even if the
group contains only one server.
Displays the AAA server configuration.
Switches to nac-policy-nac-framework
configuration mode.
Specifies the group used for NAC posture validation.
server-group must match the server-tag variable
specified in the aaa-server host command. It is
optional if you are using the no version of the
command.
Specifies acs-group1 as the authentication server
group used for NAC posture validation.
Removes the command from the NAC policy.
Cisco ASA Series CLI Configuration Guide
Configuring a NAC Policy
1-9