Filter
Top Products
60 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems
– Quarantine
– Infected
– Unknown
Posture notification (3f)
After the ACS has determined the posture token it performs these actions:
a. Cisco Secure ACS sends the system posture token to the network client.
b. The Cisco Secure ACS sends the network client an action to be taken that
is the result of the client being assigned to a group complying to a
particular policy level. If a customer uses the IBM Integrated Security
Solution for Cisco Networks with Configuration Manager integration and
the client happens to get a token “quarantine,” the results parameter will be
the
remediation URL pointing to the Configuration Manager server.
c. Cisco Secure ACS sends the NAD device the RADIUS attributes as
configured in the mapped user group, including ACLs or RACs as per
network access policy and attribute-value pairs. The optional user
notification can be used to display meaningful messages to the client that
correspond to the posture token assigned to the network client. The
access policy depends on the policy defined by the organization’s network
policy.
d. When the Cisco Secure ACS sends the system posture token to the
NAC-client computer, the ACS ends the PEAP session with the client.
e. Cisco Secure ACS logs the results of the posture validation request.
Network policy enforcement (3g)
The NAD device enforces network access as dictated by Cisco Secure ACS
in its RADIUS response. By configuring group mapping, you define
authorizations and, therefore, network access control, based on the system
posture token determined as a result of posture evaluation.
To fully control what resources users have access to under all conditions, a
mapping of default user groups, posture tokens, and access restrictions is
specified in ACS. In general, each user will be assigned to a default user
group based on his authentication. Each user group is mapped to several
posture tokens, and each combination of user group to posture token can be
assigned either a RADIUS Access Control set or a downloadable IP ACL
filter.