NAC Implementation ACS/Win and CVPN3030

[mmedwid]

Anyone else find the documentation for implementing NAC on ACS 3.3/Win and CVPN3k a little confusing?

http://cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a00802335f1.html

I finally got the certificates installed on ACS. But implementing the remainder is baffling. In the end I want to verify that users have up-to-date Symantec virus definitions or at the very least that they're running SAV. The document above references pushing ACLs to Cisco IOS devices but doesn't talk about pushing policy to the CVPN. Any tips, URLs or words of encouragement are appreciated.

[didyap]

As a NAC authenticator, the VPN Concentrator does the following:

Initiates the exchange of credentials with the peer after IPSec session establishment and periodically thereafter

Relays credential requests and responses between the peer and the authentication (ACS) server using Extensible Authentication Protocol (EAP)

Enforces network access policy on an interface based on posture validation results from the ACS server

Implements the configured EAP status query method

Supports a local exception list based on the peer operating system

Requests access policies from the ACS server for clientless hosts