Dell Powerconnect W-ClearPass Hardware Appliances W-ClearPass Policy Manager 6 - Page 95

Service Type Description/ Available Policy Components (in tabs)/ Service Rule (in Rules Editor)/ Service-specific policy components (called out with legend below) You can enable posture checking for this kind of service if you are deploying Policy Manager in a Microsoft NAP or Cisco NAC framework environment, or if you are deploying aDell hosted captive portal that does posture checks through a dissolvable agent. You can also choose to Enable auto-remediation of non-compliant end-hosts and enter the Remediation URL of a server resource that can perform remediation action (when a client is quarantined). For more information on configuring Posture Polices and Posture Servers refer to topics: "Adding and Modifying Posture Policies " on page 172 and "Adding and Modifying Posture Servers " on page 199. By default, this type of service does not have Audit checking enabled. To enable posture checking for this service select the Audit End-hosts check box on the Service tab. Select an Audit Server - either built-in or customized. Refer to "Configuring Audit Servers" on page 204 for audit server configuration steps. You can specify to trigger an audit always, when posture is not available, or for MAC authentication requests. If For MAC authentication requests is specified, then you can perform an audit For known end-hosts only or For unknown end hosts only, or For all end hosts. Known end hosts are defined as those clients that are found in the authentication source(s) associated with this service. Performing audit on a client is an asynchronous task, which means the audit can be performed only after the MAC authentication request has been completed and the client has acquired an IP address through DHCP. Once the audit results are available, there should be a way for Policy Manager to re-apply policies on the network device. This can be accomplished in one of the following ways: l No Action: The audit will not apply policies on the network device after this audit. l Do SNMP bounce: This option will bounce the switch port or to force an 802.1X reauthentication (both done via SNMP). NOTE: Bouncing the port triggers a new 802.1X/MAC authentication request by the client. If the audit server already has the posture token and attributes associated with this client in its cache, it returns the token and the attributes to Policy Manager. l Trigger RADIUS CoA action: This option sends a RADIUS Change of Authorization command to the network device by Policy Manager. You must select an enforcement policy (see "Configuring Enforcement Policies " on page 229) for a service. Optionally configure Profiler settings. Select one or more Endpoint Classification items from the drop down list, then select the RADIUS CoA action. You can also create a new action by selecting the Add new RADIUS CoA Action link. Dell Networking W-ClearPass Policy Manager 6.0 | User Guide 95