Cisco 7604 Configuration Manual page 793

Chapter 45 Configuring Network Admission Control
•
•
•
•
•
Hold Timer
The hold timer prevents a new EAPoUDP session from immediately starting after the previous attempt
to validate the session fails. This timer is used only when the Cisco Secure ACS sends a Accept-Reject
message to the switch.
The default value of the hold timer is 180 seconds (3 minutes).
An EAPoUDP session might not be validated because the posture validation of the host fails, a session
timer expires, or the switch or Cisco Secure ACS receives invalid messages. If the switch or
authentication server continuously receives invalid messages, a malicious user might be trying to cause
a denial-of-service attack.
Idle Timer
The idle timer controls how long the switch waits for an ARP packet from the postured host or a
refreshed entry in the IP device tracking table to verify that the host is still connected. The idle timer
works with a list of known hosts to track hosts that have initiated posture validation and the IP device
tracking table.
The idle timer is reset when the switch receives an ARP packet or when an entry in the IP device tracking
table is refreshed. If the idle timer expires, the switch ends the EAPoUDP session on the host, and the
host is no longer validated.
The default value of the idle timer is calculated as the probe interval times the number of probe retries.
By default, the idle timer default is 90 seconds which is the probe interval of 30 seconds times the
number of probe retries of 3.
The switch maintains a list of known hosts to track hosts that have initiated posture validation. When the
switch receives an ARP packet, it resets the aging timers for the list and the idle timer. If the aging time
of the list expires, the switch sends an ARP probe to verify that the host is present. If the host is present,
it sends a response to the switch. The switch updates the entry in the list of known hosts. The switch then
resets the aging timers for the list and the idle timer. If the switch receives no response, the switch ends
the session with the Cisco Secure ACS, and the host is no longer validated.
The switch uses the IP device tracking table to detect and manage hosts connected to the switch. The
switch also uses ARP or DHCP snooping to detect hosts. By default, the IP device tracking feature is
disabled on a switch. You must enable the IP device tracking feature to use NAC Layer 2 IP validation.
When IP device tracking is enabled, and a host is detected, the switch adds an entry to the IP device
tracking table that includes this information:
•
•
•
If NAC Layer 2 IP validation is enabled on an interface, adding an entry to the IP device tracking table
initiates posture validation.
OL-4266-08
Hold Timer, page 45-9
Idle Timer, page 45-9
Retransmission Timer, page 45-10
Revalidation Timer, page 45-10
Status-Query Timer, page 45-11
IP and MAC address of the host
Interface on which the switch detected the host
Host state that is set to ACTIVE when the host is detected
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
Understanding NAC
45-9