CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide, 9.2

Step 1

show running-config nac-policy

Views any NAC policies that are already set up on the ASA.

Shows the configuration of a NAC policy named nac-framework1

Step 2

• default-acl—NAC default ACL applied before posture validation. Following posture validation, the security appliance replaces the default ACL with the one obtained from the Access Control Server for the remote host. The ASA retains the default ACL if posture validation fails.
• reval-period—Number of seconds between each successful posture validation in a NAC Framework session.
• sq-period—Number of seconds between each successful posture validation in a NAC Framework session and the next query for changes in the host posture.
• exempt-list—Operating system names that are exempt from posture validation. Also shows an optional ACL to filter the traffic if the remote computer’s operating system matches the name.
• authentication-server-group—Name of the of authentication server group to be used for NAC posture validation.

Shows the nac-framework attributes.

Step 3

show nac-policy

Displays the assignment of NAC policies to group policies.

Shows which NAC policies are unassigned and the usage count for each NAC policy.

Step 4

• applied session count—Cumulative number of VPN sessions to which this ASA applied the NAC policy.
• applied group-policy count—Cumulative number of group polices to which this ASA applied the NAC policy.
• group-policy list—List of group policies to which this NAC policy is assigned. In this case, the usage of a group policy does not determine whether it appears in this list; if the NAC policy is assigned to a group policy in the running configuration, then the group policy appears in this list.

Explains the fields in the show nac-policy command.

Note When a policy is not assigned to any group policies, “is not in use” displays next to the policy type.

Step 1

global

Switches to global configuration mode.

Step 2

nac-policy nac-policy-name nac-framework

hostname(config-nac-policy-nac-framework)

Adds or modifies a NAC policy.

nac-policy-name is the name of a new NAC policy or one that is already present. The name is a string of up to 64 characters.

nac-framework specifies that a NAC Framework configuration will provide a network access policy for remote hosts. A Cisco Access Control Server must be present on the network to provide NAC Framework services for the ASA. When you specify this type, the prompt indicates you are in nac-policy-nac-framework configuration mode. This mode lets you configure the NAC Framework policy.

Creates and accesses a NAC framework policy named nac-framework1.

Step 3

(Optional)

[ no ] nac-policy nac-policy-name nac-framework

Removes a NAC policy from the configuration. You must specify both the name and type of the policy.

Step 4

(Optional)

clear configure nac-policy

Removes all NAC policies fromthe configuration except for those that are assigned to group policies.

Step 5

show running-config nac-policy

Displays the name and configuration of each NAC policy already present on the security appliance.

Step 1

aaa-server host

Names the Access Control Server group even if the group contains only one server.

Step 2

(Optional)

show running-config aaa-server

hostname(config)#

Displays the AAA server configuration.

Step 3

nac-policy-nac-framework

Switches to nac-policy-nac-framework configuration mode.

Step 4

authentication-server-group server-group

hostname(config-nac-policy-nac-framework)

Specifies the group used for NAC posture validation.

server-group must match the server-tag variable specified in the aaa-server host command. It is optional if you are using the no version of the command.

Specifies acs-group1 as the authentication server group used for NAC posture validation.

Step 5

(Optional)

[ no ] authentication-server-group server-group

Removes the command from the NAC policy.

Step 1

nac-policy-nac-framework

Switches to nac-policy-nac-framework configuration mode.

Step 2

sq-period seconds

hostname(config-group-policy)

Changes the status query interval.

seconds must be in the range 30 to 1800 seconds (5 to 30 minutes).

Changes the query timer to 1800 seconds.

Step 3

(Optional)

[ no ] sq-period seconds

Turns off the status query timer.

Step 4

show running-config nac-policy

Displays a 0 next to the sq-period attribute, meaning the timer is turned off.

Step 1

nac-policy-nac-framework

Switches to nac-policy-nac-framework.

Step 2

reval-period seconds

hostname(config-nac-policy-nac-framework)

Changes the interval between each successful posture validation.

seconds must be in the range is 300 to 86400 seconds (5 minutes to 24 hours).

Step 3

(Optional)

[ no ] reval-period seconds

Turns off the status query timer.

Step 4

show running-config nac-policy

Displays a 0 next to the sq-period attribute, which means the timer is turned off.

Step 1

nac-policy-nac-framework

Switches to nac-policy-nac-framework configuration mode.

Step 2

default-acl acl-name

hostname(config-nac-policy-nac-framework)

Specifies which ACL to use as the default ACL for NAC sessions.

acl-name is the name of the access control list to be applied to the session.

Identifies ac1-2 as which ACL to apply before posture validation succeeds.

Step 3

(Optional)

[ no ] default-acl acl-name

Removes the command from the NAC framework policy. Specifying the acl-name is optional.

Step 1

nac-policy-nac-framework

Switches to nac-policy-nac-framework configuration mode.

Step 2

exempt-list os " os-name " [ disable | filter acl-name [ disable ]

hostname(config-group-policy)

hostname(config-nac-policy-nac-framework)

hostname(config-nac-policy-nac-framework)

Adds an entry to the list of remote computer types that are exempt from NAC posture validation.

• os-name is the operating system name. Use quotation marks if the name includes a space (for example, “Windows XP”).
• filter applies an ACL to filter the traffic if the computer’s operating system matches the os name. The filter/ acl-name pair is optional.
• disable performs one of two functions, as follows:

– If you enter it after the "os-name," the ASA ignores the exemption, and applies NAC posture validation to the remote hosts that are running that operating system.

– If you enter it after the acl-name, ASA exempts the operating system, but does not apply the ACL to the associated traffic.

• acl-name is the name of the ACL present in the ASA configuration. When specified, it must follow the filter keyword.

Adds all hosts running Windows XP to the list of computers that are exempt from posture validation.

Exempts all hosts running Windows XP and applies the ACL acl-2 to traffic from those hosts

Removes the same entry from the exemption list.

Step 3

(Optional)

[ no ] exempt-list os " os-name " [ disable | filter acl-name [ disable ] ]

hostname(config-nac-policy-nac-framework)

Removes all exemptions from the NAC framework policy. Specifying an entry when issuing the no form of the command removes the entry from the exemption list.

Removes all entries from the exemption list.

Step 1

group-policy

Switches to group-policy configuration mode.

Step 2

nac-settings { value nac-policy-name | none }

hostname(config-group-policy)

Assigns a NAC policy to a group policy.

• nac-settings none removes the nac-policy-name from the group policy and disables the use of a NAC policy for this group policy. The group policy does not inherit the nac-settings value from the default group policy.
• nac-settings value assigns the NAC policy you name to the group policy.

Assigns the NAC policy named framework1 to the group policy.

Step 3

(Optional)

[ no ] nac-settings { value nac-policy-name | none }

Removes the nac-policy-name from the group policy. The group policy inherits the nac-settings value from the default group policy.

Step 4

( Optional)

show running-config nac-policy

Displays the name and configuration of each NAC policy

Step 1

global

Switches to global configuration mode.

Step 2

eou allow { audit | clientless | none }

hostname(config)#

Enables clientless authentication for a NAC framework configuration.

• audit uses an audit server to perform clientless authentication.
• clientless uses a Cisco Access Control Server to perform clientless authentication.
• none disables clientless authentication.

Shows how to configure the ASA to use an audit server to perform clientless authentication.

Step 3

[ no ] eou allow { audit | clientless | none }

hostname(config)#

Removes the command from the configuration.

Disables the use of an audit server.

Step 1

global

Switches to global configuration mode.

Step 2

eou clientless username username

hostname(config)#

Changes the username used for clientless authentication.

username must match the username configured on the Access Control Server to support clientless hosts. Enter 1 to 64 ASCII characters, excluding leading and trailing spaces, pound signs (#), question marks (?), quotation marks ("), asterisks (*), and angle brackets (< and >).

Changes the username and password for clientless authentication to sherlock and 221B-baker respectively. You can specify only the username, only the password, or both.

Step 3

eou clientless password password

Changes the password used for clientless authentication.

password must match the password configured on the Access Control Server to support clientless hosts. Enter 4 – 32 ASCII characters.

Step 4

(Optional)

no eou clientless username

hostname(config)#

Changes the username to its default value.

Step 5

(Optional)

no eou clientless password

hostname(config)# no eou clientless password

hostname(config)#

Changes the password to its default value.

Step 1

global

Switches to global configuration mode.

Step 2

eou port port_number

hostname(config)# eou port 62445
hostname(config)#

The default port number is 21862. This command changes the port number (on the client endpoint) used for EAP over UDP communication with posture agents.

port_number must match the port number configured on the CTA. Enter a value in the range 1024 to 65535.

Changes the port number for EAP over UDP communication to 62445.

Step 3

(Optional)

no eou port

hostname(config)# no eou port
hostname(config)#

Changes the port number to its default value.

Step 4

eou timeout retransmit seconds

hostname(config)# eou timeout retransmit 6

hostname(config)#

Changes the retransmission retry timer. When the ASA sends an EAP over UDP message to the remote host, it waits for a response. If it fails to receive a response within n seconds, it resends the EAP over UDP message. By default, the retransmission timer is 3 seconds.

seconds is a value in the range 1 to 60.

Changes the retransmission timer to 6 seconds.

Step 5

(Optional)

no eou timeout retransmit

hostname(config)# no eou timeout retransmit
hostname(config)#

Changes the retransmission retry timer to its default value.

Step 6

eou max-retry retries

hostname(config)# eou max-retry 1

hostname(config)#

Changes retransmission retries. When the ASA sends an EAP over UDP message to the remote host, it waits for a response. If it fails to receive a response, it resends the EAP over UDP message. By default, it retries up to 3 times.

retries is a value in the range 1 to 3.

Limits the number of EAP over UDP retransmissions to 1.

Step 7

(Optional)

no eou max-retry

hostname(config)# no eou max-retry
hostname(config)#

Changes the maximum number of retransmission retries to its default value.

Step 8

eou timeout hold-period seconds

hostname(config)# eou timeout hold-period 120
hostname(config)#

Changes the session reinitialization timer. When the retransmission retry counter matches the max-retry value, the ASA terminates the EAP over UDP session with the remote host and starts the hold timer. When the hold timer equals n seconds, the ASA establishes a new EAP over UDP session with the remote host. By default, the maximum number of seconds to wait before establishing a new session is 180 seconds.

seconds is a value in the range 60 to 86400.

Changes the wait period before initiating a new EAP over UDP association to 120 seconds

Step 9

(Optional)

no eou timeout hold-period

hostname(config)# no eou timeout hold-period
hostname(config)#

Changes the session reinitialization to its default value.