Remediating Infranet Controller Host Checker Policies - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING INFRANET CONTROLLER GUIDE REV 01 Manual

NSM Infranet Controller Configuration Guide
Related
Documentation

Remediating Infranet Controller Host Checker Policies

174
Specify global Host Checker restrictions. See "Creating Infranet Controller Global Host
1.
Checker Policies (NSM Procedure)."
If you want to implement Host Checker at the realm level and role level, see
2.
"Configuring Infranet Controller Host Checker Access Restrictions (NSM Procedure)."
If you want to create role-mapping rules based on a user's Host Checker status, see
3.
"Configuring Role Mapping Rules (NSM Procedure)."
Remediating Infranet Controller Host Checker Policies on page 174
Executing Host Checker Policies on page 170
You can specify general remediation actions that you want Host Checker to take if an
endpoint does not meet the requirements of a policy. For example, you can display a
remediation page to the user that contains specific instructions and links to resources
to help the user bring their endpoint into compliance with Host Checker policy
requirements.
You can also choose to include a message to users (called a reason string) that is returned
by Host Checker or an integrity measurement verifier (IMV) that explains why the client
machine does not meet the Host Checker policy requirements.
General Host Checker Remediation User Experience
Users may see the remediation page in the following situations:
Before the user signs in:
If you enable custom instructions or reason strings for a policy that fails, the Infranet
Controller displays the remediation page to the user. The user has two choices:
Take the appropriate actions to make his computer conform to the policy and
then click the Try Again button on the remediation page. Host Checker checks the
user's computer again for compliance with the policy.
Leave his computer in its current state and click the Continue button to sign in to
the Infranet Controller. He cannot access the realm, role, or resource that requires
compliance with the failed policy.
NOTE: If you do not configure the Infranet Controller with at least one
realm that allows access without enforcing a Host Checker policy, the
user must bring his computer into compliance before signing into the
Infranet Controller.
If you do not enable custom instructions or reason strings for a policy that fails, Host
Checker does not display the remediation page to the user. Instead, a message
appears telling the user that no additional information has been provided and to
Copyright © 2010, Juniper Networks, Inc.