Cisco 3.3 User Manual page 580

Implementing Network Admission Control
b.
Configure the Unknown User Policy to include NAC databases. When unknown
Step 9
user processing is enabled, Cisco Secure ACS uses the Unknown User Policy to
determine if it has a NAC database whose mandatory credential types are satisfied
by the attributes received from the NAC client. Of the NAC databases included in
the Selected Databases list on the Configure Unknown User Policy page,
Cisco Secure ACS uses the first one whose mandatory credential types are
satisfied to process the posture validation request.
For detailed steps, see
Note
For each SPT, create a downloadable IP ACL set that limits network access
Step 10
appropriately. If you have more than one NAC database and need to control
network access differently for the same SPT for each NAC, you must create
downloadable IP ACLs per SPT per NAC database. For example, if you have two
NAC databases, one for NAI posture validation and one for Symantec posture
validation, you may want separate downloadable IP ACLs for a Quarantine SPT,
one that allows access only to a Symantec anti-virus server and one that allows
access only to a NAI anti-virus server.
For detailed steps, see
For each group to which you have mapped an SPT, follow these steps:
Step 11
a.
User Guide for Cisco Secure ACS for Windows Server
14-8
Create SPT-to-user-group mappings. Each NAC database has its own group
mappings.
For detailed steps, see
Configuring the Unknown User Policy, page
You may want to create a default NAC database and place it at the bottom
of the Selected Databases list. A default NAC database has no mandatory
credential types and therefore can perform posture validation for any
request, regardless of the credentials included in the request.
Adding a Downloadable IP ACL, page
Assign the appropriate ACLs to the group. For example, to the group intended
to authorize NAI NAC clients whose posture validation returned an Infected
SPT, assign the ACL you created to control access of NAI NAC clients whose
system posture is Quarantine.
For detailed steps, see
page 6-30.
Chapter 14
Configuring NAC Group Mapping, page
Assigning a Downloadable IP ACL to a Group,
Network Admission Control
16-13.
15-16.
5-10.
78-16592-01