Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual page 698

Understanding NAC
The architecture assumes that the audit server can be reached so that the host can communicate with it.
When a host (endpoint device) makes network access through the NAD configured for posture
validation, the network access device eventually requests the AAA server (Cisco Secure ACS) for an
access policy to be enforced for the host. The AAA server can be configured to trigger a scan of the host
with an external audit server. The audit server scan happens asynchronously and can take several seconds
to complete. During the time of the audit server scan, the AAA server conveys a minimal restrictive
security policy to NAD for enforcement along with a short poll timer (session-timeout). The NAD polls
the AAA sever at the specified timer interval until the result is available from the audit server. After the
AAA server receives the audit result, it computes an access policy based on the audit result and is sent
down to NAD for enforcement on its next request.
ACLs
If you configure NAC Layer 2 IP validation on a switch port, you must also configure a default port ACL
on a switch port. You should also apply the default ACL to IP traffic for hosts that have not completed
posture validation.
If the default ACL is configured on the switch and the Cisco Secure ACS sends a host access policy to
the switch, the switch applies the policy to traffic from the host connected to a switch port. If the policy
applies to the traffic, the switch forwards the traffic. If the policy does not apply, the switch applies the
default ACL. However, if the switch gets an host access policy from the Cisco Secure ACS but the default
ACL is not configured, the NAC Layer 2 IP configuration does not take effect.
If the Cisco Secure ACS sends the switch a downloadable ACL that specifies a redirect URL as a
policy-map action, this ACL takes precedence over the default ACL already configured on the switch
port. The redirect URL ACL policy also takes precedence over the policy already configured on the host.
If the default port ACL is not configured on the switch, the switch can still apply the downloadable ACL
from the Cisco Secure ACS.
NAC Timers
The switch supports these timers:
•
•
•
•
•
Hold Timer
The hold timer prevents a new EAPoUDP session from immediately starting after the previous attempt
to validate the session fails. This timer is used only when the Cisco Secure ACS sends a Accept-Reject
message to the switch.
The default value of the hold timer is 180 seconds (3 minutes).
An EAPoUDP session might not be validated because the posture validation of the host fails, a session
timer expires, or the switch or Cisco Secure ACS receives invalid messages. If the switch or
authentication server continuously receives invalid messages, a malicious user might be trying to cause
a denial-of-service attack.
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
41-8
Hold Timer, page 41-8
Idle Timer, page 41-9
Retransmission Timer, page 41-10
Revalidation Timer, page 41-10
Status-Query Timer, page 41-10
Chapter 41 Configuring Network Admission Control
OL-11439-03