topic NAC url direct using concentrator in Network Security

NAC url direct using concentrator

followurself — Fri, 21 Feb 2020 08:40:10 GMT

we have a vpn concentrator 3030 runing 4.7 ver, have deployed csa 4.5 and cta 1.0 agents on the client.acs 3.3 is the policy server with local policies created. NAC process takes place and could see all the logs going well.under the quarantine group have created a acl to block certain connections which also works well..the only problem we are facing is the url direct. below are the settign set

posture-token=Quarantine

url-

redirect=http://10.1.100.47/

status-query=30

revalidation-timeout=300

This doesnt get poped up.Will this work with the concentrator or is it only limited to cisco routers and firewalls.how do i get the url direct working with vpn concentrator being the NAD device

Re: NAC url direct using concentrator

jan.nielsen — Wed, 25 Jan 2006 12:31:24 GMT

I had the same issue untill i discovered that the url has to be a hostname, not an ip address.

Re: NAC url direct using concentrator

followurself — Wed, 25 Jan 2006 12:43:52 GMT

Thanks Jan, i shall try and update

Re: NAC url direct using concentrator

followurself — Fri, 27 Jan 2006 11:36:19 GMT

Hello Jan

I tried with the hostname but it doesnt work, is there anything which i need to check on ACS because i cant see the cisco/av pair attributes in passed authentications.it looks like it doesnt send it

Re: NAC url direct using concentrator

cammaher — Wed, 01 Feb 2006 01:21:49 GMT

Hi Followurself,

I am doing exactly the same and have sen up NAC using a VPN 3020 as the NAD device. I have got the URL-redirect working.

From my understanding, for the URL-redirect to work youhave to modify the settings on the Cisco Trust Agent. I am using CTA v2.0.0.30 and this setting is enabled by default. The setting is located in the 'ctad.ini' file that is installed along with the client. In this file there are settings under the {UserNotifies] section that defines the behaviour of pop-up messages sent from the ACS to the CTA.

Let me know how you go!

Cheers,

Cam

PS - I can send you the doco on the CTA v2 if you like.

Re: NAC url direct using concentrator

followurself — Wed, 01 Feb 2006 15:51:53 GMT

Hi,

I m using cta 1.0, can you let me know which setting in ctad.ini i need to look into.

Now here we talking about web url direct to work when you have a cta installed but what if we want the same to work for clientless user. when we enable a clientless policy on concentrator and same get authenticated by the ACS server.can we make a url direct to work here..so the users will isntall cta/csa and then they go in

Re: NAC url direct using concentrator

followurself — Thu, 02 Feb 2006 16:57:50 GMT

Hi,

I tried with CTA 2.0 and checked the settings in ini file but still the web direct configured in acs under

cisco/av pair isnt working

posture-token=Quarantine

url

-redirect=http://xxxx/

status-query=30

revalidation-timeout=300