Cisco Cisco NAC Appliance 4.1.0
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
OL-12214-01
Chapter 8 Configuring Active Directory Single Sign-On (AD SSO)
Enabling a Login Script (Optional)
In any type of deployment, you need to create an artificial delay script to run during authentication in
order for local or network-based scripts to work correctly. See
order for local or network-based scripts to work correctly. See
For network-based script use in Out-of-Band deployments with IP address changes, you must also:
•
Append the delete command to the end of the “delay” script.
•
Use a reference script that copies the “delay” script to the client machine and then launches it.
For more information, see
Introducing a Delay to Allow Script Use
You can introduce delay by calling a persistent check action that fails until authentication finishes. For
example, you can use ping, Telnet, nslookup, or another action that requires network connectivity to
succeed. The following example is a .bat script, but you can use other types of scripts.
example, you can use ping, Telnet, nslookup, or another action that requires network connectivity to
succeed. The following example is a .bat script, but you can use other types of scripts.
When using ping, remember:
•
You can ping any IP address that is reachable after Clean Access login succeeds.
•
The IP address used for the ping and the DC do not have to be the same.
Caution
If you ping a protected device that has a real IP address, the user will be able to see the IP address while
the delay script runs. You can add a statement to the script to hide the DOS window.
the delay script runs. You can add a statement to the script to hide the DOS window.
•
You only need one IP address.
•
All of your mappings can be assigned after the ping succeeds.
Example
:CHECK
@echo off
echo Please wait...
ping -n 1 -l 1 192.168.88.128
if errorlevel 1 goto CHECK
@echo on
netuse L:\\192.168.88.128\Scripttest
Table 8-3
Network-Based Login Script Options
Deployment
Option
In Band
Open access to the DC port in the Temporary or Unauthenticated
user role and introduce a delay in the body of the script.
user role and introduce a delay in the body of the script.
Out-of-Band without IP change
Open access to the DC port in the Temporary or Unauthenticated
user role and introduce a delay in the body of the script.
user role and introduce a delay in the body of the script.
Out-of-Band with IP change
Use a combination of scripts to copy a script that introduces delay
locally, run it, and then delete it.
locally, run it, and then delete it.
Note
A security concern exists while the script resides on the
client machine because it can be viewed or copied.
client machine because it can be viewed or copied.