Cisco ASA Series Cli Configuration Manual page 1773

Chapter 1 Configuring Network Admission Control
Assigning a NAC Policy to a Group Policy
Upon completion of each tunnel setup, the ASA applies the NAC policy, if it is assigned to the group
policy, to the session. By default, the
group policy. The ASA automatically enables NAC for a group policy when you assign a NAC policy to
it.
Detailed Steps
Command
Step 1
group-policy
Step 2
nac-settings { value nac-policy-name | none }
Example:
hostname(config-group-policy)# nac-settings value
framework1
hostname(config-group-policy)
Step 3
(Optional)
[ ]
no nac-settings
Step 4
(Optional)
show running-config nac-policy
Changing Global NAC Framework Settings
The ASA provides default settings for a NAC Framework configuration. Use the instructions in this
section to adjust these settings for adherence to the policies in force in your network.
Changing Clientless Authentication Settings
NAC Framework support for clientless authentication is configurable. It applies to hosts that do not have
a Cisco Trust Agent to fulfill the role of posture agent. The ASA applies the default access policy, sends
the EAP over UDP request for posture validation, and the request times out. If the ASA is not configured
to request a policy for clientless hosts from the Access Control Server, it retains the default access policy
already in use for the clientless host. If the ASA is configured to request a policy for clientless hosts
from the Access Control Server, it does so and the Access Control Server downloads the access policy
to be enforced by the ASA.
{ value nac-policy-name | none }
command is not present in the configuration of each
nac-settings
Purpose
Switches to group-policy configuration mode.
Assigns a NAC policy to a group policy.
•
nac-settings none
nac-policy-name from the group policy and
disables the use of a NAC policy for this group
policy. The group policy does not inherit the
nac-settings value from the default group policy.
•
nac-settings value
you name to the group policy.
Assigns the NAC policy named framework1 to the
group policy.
Removes the nac-policy-name from the group
policy. The group policy inherits the nac-settings
value from the default group policy.
Displays the name and configuration of each NAC
policy
Cisco ASA Series CLI Configuration Guide
Assigning a NAC Policy to a Group Policy
removes the
assigns the NAC policy
1-13