IC Host Checker Policy

[aeroplane_]

Hi

I would like to know, after the end point authentication when IC checks the end point is compliant with my host checker policy or not then IC should give that ROLE (even user is not compliant to security policy) but it should send the logs through SNMP to my NMS that this user is not compliant with the host checker policy.

Kindly advice the configuration for this requirement on IC.

Thanks

[mnarine_]

What you want to do is set the restrictions on the role to evaluate the Host Checker policies but not enforce it. This way the user will still be able to map into the role but a message will be logged.

-Mike

[aeroplane_]

Hi Mike

Thanks for the input. But as per your advice I checked the role level restrictions options for host checker and I found that there are no such things like evaluate or enforce. I just found two options there:

Allow all users (Host Checker not required)

Allow users whose workstations meet the requirements specified by these Host Checker policies:

But I checked on realm level restrictions and I found these options which you mentioned that is evaluate or enforce.

Can you please advice If we would like to only evaluate host checker policies on role level but host checker policy should not enforced the how I can do this?

Thanks

Allow all users (Host Checker not required)

Allow users whose workstations meet the requirements specified by these Host Checker policies:

[mnarine_ · Accepted solution]

Hi,

What you want to do is evaluate the policies on the realm level. If you do not want it to be a requirement for a role, then you don't do anything at the role level. You will stil get a log message generated stating if the user pass/fail the policies based on evaulate only. This configuration will not prevent the user from logging in and being mapped to a specific role.

-Mike

[aeroplane_]

Thanks for your help. I have added the IC in to the NSMXpress so could you please confirm that these logs I means users logs indicating user has passed the host checker policy or not, would be send by IC to NSMXpress??

Thanks