1-71
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
hostname(config-group-policy)# nac-sq-period seconds
hostname(config-group-policy)#
To inherit the value of the status query timer from the default group policy, access the alternative group
policy from which to inherit it, then use the no form of this command:
hostname(config-group-policy)# no nac-sq-period [seconds]
hostname(config-group-policy)#
The following example changes the value of the status query timer to 1800 seconds:
hostname(config-group-policy)# nac-sq-period 1800
hostname(config-group-policy)
The following example inherits the value of the status query timer from the default group policy:
hostname(config-group-policy)# no nac-sq-period
hostname(config-group-policy)#
Step 2 (Optional) Configure the NAC revalidation period. The security appliance starts the revalidation timer
after each successful posture validation. The expiration of this timer triggers the next unconditional
posture validation. The security appliance maintains posture validation during revalidation. The default
group policy becomes effective if the Access Control Server is unavailable during posture validation or
revalidation. Enter the interval in seconds between each successful posture validation. The range is 300
through 86400. The default setting is 36000.
To specify the interval between each successful posture validation in a Network Admission Control
session, use the nac-reval-period command in group-policy configuration mode:
hostname(config-group-policy)# nac-reval-period seconds
hostname(config-group-policy)#
To inherit the value of the Revalidation Timer from the default group policy, access the alternative group
policy from which to inherit it, then use the no form of this command:
hostname(config-group-policy)# no nac-reval-period [seconds]
hostname(config-group-policy)#
The following example changes the revalidation timer to 86400 seconds:
hostname(config-group-policy)# nac-reval-period 86400
hostname(config-group-policy)
The following example inherits the value of the revalidation timer from the default group policy:
hostname(config-group-policy)# no nac-reval-period
hostname(config-group-policy)#
Step 3 (Optional) Configure the default ACL for NAC. The security appliance applies the security policy
associated with the selected ACL if posture validation fails. Specify none or an extended ACL. The
default setting is none. If the setting is none and posture validation fails, the security appliance applies
the default group policy.
To specify the ACL to be used as the default ACL for Network Admission Control sessions that fail
posture validation, use the nac-default-acl command in group-policy configuration mode:
hostname(config-group-policy)# nac-default-acl {acl-name | none}
hostname(config-group-policy)#
To inherit the ACL from the default group policy, access the alternative group policy from which to
inherit it, then use the no form of this command:
hostname(config-group-policy)# no nac-default-acl [acl-name | none]
hostname(config-group-policy)#
To Next Page
Loading...
Need help?
General
