C H A P T E R
1-1
Cisco ASA Series CLI Configuration Guide
1
Configuring Network Admission Control
This chapter includes the following sections:
•
Information about Network Admission Control, page 1-1
•
Licensing Requirements, page 1-2
•
Prerequisites for NAC, page 1-4
•
Guidelines and Limitations, page 1-4
•
Viewing the NAC Policies on the Security Appliance, page 1-5
•
Adding, Accessing, or Removing a NAC Policy, page 1-7
•
Configuring a NAC Policy, page 1-8
•
Assigning a NAC Policy to a Group Policy, page 1-13
•
Changing Global NAC Framework Settings, page 1-13
Information about Network Admission Control
Network Admission Control protects the enterprise network from intrusion and infection from worms,
viruses, and rogue applications by performing endpoint compliancy and vulnerability checks as a
condition for production access to the network. We refer to these checks as
posture validation.
You can
configure posture validation to ensure that the anti-virus files, personal firewall rules, or intrusion
protection software on a host with an IPsec or WebVPN session are up-to-date before providing access
to vulnerable hosts on the intranet. Posture validation can include the verification that the applications
running on the remote hosts are updated with the latest patches. NAC occurs only after user
authentication and the setup of the tunnel. NAC is especially useful for protecting the enterprise network
from hosts that are not subject to automatic network policy enforcement, such as home PCs.
The establishment of a tunnel between the endpoint and the ASA triggers posture validation.
You can configure the ASA to pass the IP address of the client to an optional audit server if the client
does not respond to a posture validation request. The audit server, such as a Trend server, uses the host
IP address to challenge the host directly to assess its health. For example, it may challenge the host to
determine whether its virus checking software is active and up-to-date. After the audit server completes
its interaction with the remote host, it passes a token to the posture validation server, indicating the
health of the remote host.
Following successful posture validation or the reception of a token indicating the remote host is healthy,
the posture validation server sends a network access policy to the ASA for application to the traffic on
the tunnel.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......