Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 697

Chapter 41 Configuring Network Admission Control Understanding NAC • url-redirect and url-redirect-acl-Specifies the local URL policy on the switch. The switches use these cisco-av-pair VSAs as follows: - url-redirect = - url-redirect-acl = switch ACL name or number These AV pairs enable the switch to intercept an HTTP or HTTPS request from the endpoint device and forward the client web browser to the specified redirect address from which the latest antivirus files can be downloaded. The url-redirect AV pair on the Cisco Secure ACS contains the URL to which the web browser will be redirected. The url-redirect-acl AV pair contains the name or number of an ACL that specifies the HTTP or HTTPS traffic to be redirected. The ACL must be defined on the switch. Traffic that matches a permit entry in the redirect ACL will be redirected. These AV pairs may be sent if the host's posture is not healthy. Note You can redirect the URL for either HTTP or HTTPS but not for both at the same time. This situation occurs because the Cisco IOS software HTTP server can either listen to the HTTP port or to the HTTPS port but cannot listen to both at the same time. For more information about AV pairs that are supported by Cisco IOS software, see the ACS configuration and command reference documentation about the software releases running on the AAA clients. Audit Servers End devices that do not run Cisco Trust Agent (CTA) will not be able to provide credentials when challenged by Network Access Devices. These devices are described as agentless or nonresponsive. The NAC architecture has been extended to incorporate audit servers. An audit server is a third-party server that can probe, scan, and determine security compliance of a host without the need for presence of Cisco trust agent on the host. The result of the audit server examination can influence the access servers to make host-specific network access policy decisions instead of enforcing a common restrictive policy for all nonresponsive hosts. You can build more robust host audit and examination functionality by integrating any third-party audit operations into the NAC architecture. Figure 41-3 shows how audit servers fit into the typical topology. Figure 41-3 NAC Device Roles Audit server Endpoint device Audit mechanisms e.g. port scan GAMEP IP traffic NAD Intercept IP traffic from new endpoint Radius AAA server 140123 OL-11439-03 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY 41-7