Cisco FirePOWER ASA 5500 series Configuration Manual page 606

Group Policies
To add an entry to the list of remote computer types that are exempt from posture validation, use the
vpn-nac-exempt command in group-policy configuration mode.
hostname(config-group-policy)# vpn-nac-exempt os "os name" [filter {acl-name | none}]
[disable]
hostname(config-group-policy)#
To disable inheritance and specify that all hosts are subject to posture validation, use the none keyword
immediately following vpn-nac-exempt.
hostname(config-group-policy)# vpn-nac-exempt none
hostname(config-group-policy)#
To remove an entry from the exemption list, use the no form of this command and name the operating
system (and ACL) in the entry to be removed.
hostname(config-group-policy)# no vpn-nac-exempt [os "os name"] [filter {acl-name | none}]
[disable]
hostname(config-group-policy)#
To remove all entries from the exemption list associated with this group policy and inherit the list from
the default group policy, use the no form of this command without specifying additional keywords.
hostname(config-group-policy)# no vpn-nac-exempt
hostname(config-group-policy)#
The syntax elements for these commands are as follows:
• acl-name—Name of the ACL present in the security appliance configuration.
• disable—Disables the entry in the exemption list without removing it from the list.
filter—(Optional)
•
os name.
none—When entered immediately after vpn-nac-exempt, this keyword disables inheritance and
•
specifies that all hosts will be subject to posture validation.When entered immediately after filter,
this keyword indicates that the entry does not specify an ACL.
• OS—Exempts an operating system from posture validation.
• os name—Operating system name. Quotation marks are required only if the name includes a space
(for example, "Windows XP").
The following example adds all hosts running Windows XP to the list of computers that are exempt from
posture validation:
hostname(config-group-policy)# vpn-nac-exempt os "Windows XP"
hostname(config-group-policy)
The following example exempts all hosts running Windows 98 that match an ACE in the ACL named
acl-1:
hostname(config-group-policy)# vpn-nac-exempt os "Windows 98" filter acl-1
hostname(config-group-policy)
The following example adds the same entry to the exemption list, but disables it:
hostname(config-group-policy)# vpn-nac-exempt os "Windows 98" filter acl-1 disable
hostname(config-group-policy)
The following example removes the same entry from the exemption list, regardless of whether it is
disabled:
hostname(config-group-policy)# no vpn-nac-exempt os "Windows 98" filter acl-1
hostname(config-group-policy)
Cisco Security Appliance Command Line Configuration Guide
30-52
Chapter 30
filter to apply an ACL to filter the traffic if the computer matches the
Configuring Tunnel Groups, Group Policies, and Users
OL-10088-01