When you choose Policy > Policy Elements > Results > Client Provisioning Resources, and add a Native Supplicant Profile, you will see the following settings.

• Name—Name of the native supplicant profile that you are creating, and select which operating system(s) this profile should apply to. Each profile defines settings for a network connection that ISE will apply to the client's native supplicant.

Wireless Profile(s)

Configure one or more Wireless profiles, one for each SSID that you want to make available to the client.

• SSID Name— Name of the SSID that the client will connect to.

• Security—Configure the client to use WPA or WPA2.

• Allowed Procotol—Configure which protocol the client should use to connect to the authentication server; PEAP or EAP-TLS.

• Certificate Template—For TLS, choose one of the certificate templates defined on Administration > System Certificates > Certificate Authority > Certificate Templates.

Optional Settings are described in the section Optional Settings - for Windows.

iOS Settings

• Enable if target network is hidden

Wired Profile

• Allowed Protocol—Configure which protocol the client should use to connect to the authentication server; PEAP or EAP-TLS.

• Certificate Template—For TLS, choose one of the certificate templates that defined on Administration System Certificates Certificate Authority Certificate Templates

Optional Settings - for Windows

If you expand Optional, the following fields are also available for Windows clients.

• Automatically use logon name and password (and domain if any)—If you selected User for authentication mode, use the logon and password to without prompting the user, if that information is available.

• Enable Fast Reconnect—Allow a PEAP session to resume without checking user credentials when the session resume feature is enabled in the PEAP protocol options, which is configured on Administration > System > Settings > Protocols > PEAP.

• Enable Quarantine Checks— Check if the client has been quarantined.

• Disconnect if server does not present cryptobinding TLV—Disconnect if cryptobinding TLV is not supported for the network connection.

• Do not prompt user to authorize new servers or trusted certification authorities—Automatically accept user certificates; do not prompt the user.

• Connect even if the network is not broadcasting its name (SSID)—For Wireless profiles only.

You can create the AMP enabler profile using the ISE embedded profile editor or the standalone editor.

To create the AMP enable profile using the ISE embedded profile editor:

To create an AMP enabler profile using the AnyConnect standalone editor.

When you enter the SOURCEfire URL in the Windows or MAC Installer text box and click Check, you might encounter any of the following errors:

• Error Message: The certificate for the server containing the Mac/Windows installer file is not trusted by ISE. Add a trust certificate to Administration > Certificates > Trusted Certificates.

  This error message appears if you have not imported the SOURCEfire trusted certificate in to the Cisco ISE certificate store. Obtain a SOURCEfire trusted certificate and import it in to the Cisco ISE trusted certificate store (Administration > Certificates > Trusted Certificates).

• Error Message: The installer file is not found at this location, this may be due to a connection issue. Enter a valid path in the Installer text box or check your connection.

  This error message appears when the server hosting the AMP for Endpoint software is down or if there is a typographic error in the Windows Installer or MAC Installer text box.

• Error Message: The Windows/Mac installer text box does not contain a valid URL.

  This error message appears when you enter a syntactically incorrect URL format.

The following table describes the fields in the NAC or AnyConnect Posture Profile page, which allows you to configure parameters for the posture agent (AnyConnect and Cisco NAC Agent). The navigation path for this page is Policy > Policy Elements > Results > Client Provisioning > Resources > Add > NAC or AnyConnect Posture Profile.

Note	Merge parameter values with existing agent profile settings or overwrite them to appropriately configure agent behavior on Windows and Mac OS X clients.

Note

Agent log files are stored in a directory on the client machine. After the first login session, two files reside in the directory: one backup file from the previous log in session, and one new file containing login and operation from the current session. If the log file for the current session grows beyond the specified file size, the first segment of agent login and operation information automatically becomes the backup file in the directory. and the agent continues to record the latest entries in the current session file.

Problem

The client machine browser displays a “no policy matched” error message after user authentication and authorization. This issue applies to user sessions during the client provisioning phase of authentication.

Possible Causes

The client provisioning policy is missing required settings.

Posture Agent Download Issues

Remember that downloading the posture agent installer requires the following:

• The user must allow the ActiveX installer in the browser session the first time an agent is installed on the client machine. (The client provisioning download page prompts for this.)

• The client machine must have Internet access.

Resolution

• Ensure that a client provisioning policy exists in Cisco ISE. If yes, verify the policy identity group, conditions, and type of agent(s) defined in the policy. (Also ensure whether or not there is any agent profile configured under Policy > Policy Elements > Results > Client Provisioning > Resources > Add > NAC or AnyConnect Posture Profile, even a profile with all default values.)

• Try re-authenticating the client machine by bouncing the port on the access switch.

Cisco ISE supports coexistence of AnyConnect and legacy Cisco ISE NAC agents on Windows and Mac OS x clients. Agents start the posture discovery probe only when there is any change in the network on the clients. Cisco ISE responds to the client's posture discovery probe based on the client provisioning policy and the corresponding agent will get the discovery response, which results in only one agent being active.

Based on the client provisioning policy, Cisco ISE differs in responding to the agents posture discovery probe as below:

• If the endpoint is configured to use the legacy agent (Cisco ISE NAC agent for Windows and Mac OS x), the agent receives the discovery response with a string "X-perfigo-CAS=FQDN" in the existing format. AnyConnect stops discovery, if the discovery response is received for the legacy agent.

• If the endpoint is configured to use AnyConnect, Cisco ISE responds in a different format. This will be the Cisco ISE Policy Service node FQDN and the AnyConnect Configuration URL, AnyConnect package location and version based on the client provisioning policy. The legacy agent stops discovery, if the response is received for AnyConnect.

Problem

A client machine is granted “Temporary Access” to the network following login and authentication, but administrator and users expect full network access.

Possible Causes

This issue is applicable to any client machine login session using an agent to connect.

If the Cisco NAC Agent is running on the client and:

• The interface on the client machine goes down

• The session is terminated

Resolution

The user must try to verify network connectivity and then try to log in again (and pass through posture assessment, as well) to attempt to reestablish the connection.

Problem

The user is presented with a “Clean access server not available” message. This issue applies to any agent authentication session from Cisco ISE.

Possible Cause

This error could mean that either the session has terminated or Cisco ISE is no longer reachable on the network.

Resolution

• The user can try to log into the network again.

• The user can try to ping the default gateway or the RADIUS server IP address or FQDN supplied by the network administrator.

• The administrator can check network access attributes for the user (like the assigned VLAN, ACLs, routing, execute the nslookup command on the client, client machine DNS connection, and so on).

The Cisco NAC Agent installs to C:\Program Files\Cisco\Cisco NAC Agent\ on the Windows client.

You can uninstall the agent in the following ways:

• By double-clicking the Uninstall Cisco NAC Agent desktop icon.

• By going to Start Menu > Programs > Cisco Systems > Cisco Clean Access > Uninstall Cisco NAC Agent

• By going to Start Menu > Control Panel > Add or Remove Programs > Cisco NAC Agent and uninstall the Cisco NAC Agent.

You can uninstall Cisco NAC Agent in a Windows 8 client in Metro mode.

In Cisco NAC Agent scenarios where the user does not get network access, like "Remediation Failed" or "Network Access expired", the Agent displays the following toast notification:Network not available, Click "OK" to continue.

To get more details, you can select the toast and you will be redirected to Desktop mode and the Cisco NAC agent dialog is displayed.

Toast Notification is displayed for all positive recommended actions that the user needs to perform to gain network access. The following are some examples:

• For Network Acceptance policy, toast will be displayed as: "Click Accept to gain network access"

• For Agent/Compliance Module Upgrade, toast will be displayed as: "Click OK to Upgrade/Update"

• In the "user logged out" event, when "Auto Close" option for Logoff is not enabled in Clean Access Manager (CAM), toast notification is provided. This toast enables the users to know that they have been logged out and that they need to login again to get network access.

You can uninstall the Cisco NAC Agent for Mac OS X clients by running the uninstall script as follows:

The nac_login.xml file is one of the files that is required in your Agent screen customization package, which allows you to customize the logo, fields, and message text contained in a Cisco NAC Agent dialog, like the Properties window, to suit your specific Windows client network access requirements.

Use the following template to construct an appropriate “nac_login.xml” file to customize the logo, fields, and message text contained in a Cisco NAC Agent screen.

The following example shows a customized file.

<tr class="nacLoginMiddleSectionContainerInput"> 
<td colspan="2"> 
<fieldset width="100%" id="nacLoginCustomAlert" 
style="display:block" class="nacLoginAlertBox"> 
<table width="100%"> 
<tr> 
<td id="nacLoginCustomAlert.img" valign="top" width="32px"> 
<img src="./cues_icons/Status_warning_icon.png" align="absmiddle" 
 onload="cuesFixPNG(null,this)"></img> 
</td> 
<td id="nacLoginCustomAlert.content" class="nacLoginAlertText"> 
<cues:localize key="login.customalert"/> 
</td> 
</tr> 
</table> 
</fieldset> 
</td> 
</tr> 
<tr id="nacLoginRememberMe" style="visibility:hidden"> 
<td> 
<cues:localize key="cd.nbsp"/> 
</td> 
<td class="cuesLoginField"> 
<nobr> 
<input type="checkbox" alt="" title="" name="rememberme" 
id="rememberme" checked="true"/> 
<cues:localize key="login.remember_me"/> 
</nobr> 
</td> 
</tr> 

This is one of the files that is required in your Agent screen customization package, allows you to customize the logo, fields, and message text contained in a Cisco NAC Agent dialog, like the Properties screen, to suit your specific Windows client network access requirements.

Use the following template to construct a one or more nacStrings_xx.xml files, where xx is a two-character identifier for the specific language.

The following example shows a customized nacStrings_xx.xml file.

<cueslookup:appstrings xmlns:cueslookup="http://www.cisco.com/cues/lookup"> 
<cueslookup:name key="nac.brand.legal_name">Cisco Systems, Inc.</cueslookup:name> 
<cueslookup:name key="nac.brand.full_name">Cisco Systems</cueslookup:name> 
<cueslookup:name key="nac.brand.short_name">Cisco</cueslookup:name> 
<cueslookup:name key="nac.brand.abbreviation">Cisco</cueslookup:name> 
<cueslookup:name key="nac.copyright">Copyright </cueslookup:name> 
<cueslookup:name key="nac.copyright.period">2009-2013</cueslookup:name> 
<cueslookup:name key="nac.copyright.arr">All Rights Reserved</cueslookup:name> 
<cueslookup:name key="updateagent.rqst">NAC Agent %1 is available.%br% Do you want to install this update now?</cueslookup:name> 
<cueslookup:name key="updateagent.rqst.retry">Unable to update NAC Agent. Please try again.</cueslookup:name> 
<cueslookup:name key="downloadagent.report">Downloading the update of NAC Agent.</cueslookup:name> 
<cueslookup:name key="downloadagent.packagename.label">Package Name</cueslookup:name> 
<cueslookup:name key="downloadagent.completed.label">Completed</cueslookup:name> 
<cueslookup:name key="downloadagent.completed.value">%1 of %2 bytes</cueslookup:name> 
<cueslookup:name key="downloadagent.speed.label">Speed</cueslookup:name> 
<cueslookup:name key="downloadagent.speed.value">%1 bytes/sec</cueslookup:name> 
<cueslookup:name key="updateopswat.rqst">NAC Agent Posture component version %1 is available.%br% Do you want to install this update now?</cueslookup:name> 
<cueslookup:name key="updateopswat.rqst.retry">Unable to update NAC Agent Posture component. Please try again.</cueslookup:name> 
<cueslookup:name key="downloadopswat.report">Downloading the update of NAC Agnet Posture component.</cueslookup:name> 
<cueslookup:name key="login.productname">Education First Compliance Check</cueslookup:name> 
<cueslookup:name key="login.version">Version</cueslookup:name> 
<cueslookup:name key="login.opswatversion">Posture Component Version</cueslookup:name> 
<cueslookup:name key="login.username">Enter your username</cueslookup:name> 
<cueslookup:name key="login.password">Enter your PIN</cueslookup:name> 
<cueslookup:name key="login.remember_me">Remember Me</cueslookup:name> 
<cueslookup:name key="login.server">Server</cueslookup:name> 
<cueslookup:name key="login.customalert">Custom EF package version 2.1.1.1 with EF Logo</cueslookup:name> 
<cueslookup:name key="login.Too many users using this account">This account is already active on another device</cueslookup:name> 
<cueslookup:name key="login.differentuser">Login as Different User</cueslookup:name> 
<cueslookup:name key="login.removeoldest">Remove Oldest Login Session</cueslookup:name> 
<cueslookup:name key="menu_devtools">Dev Tools</cueslookup:name> 
<cueslookup:name key="c.sso.ad">Performing Windows Domain automatic login for NAC</cueslookup:name> 
<cueslookup:name key="c.sso.generic">Unknown authentication type</cueslookup:name> 
<cueslookup:name key="c.sso.macauth">Performing device filter automatic login for NAC</cueslookup:name> 
<cueslookup:name key="c.sso.vpn">Performing automatic login into NAC environment for remote user</cueslookup:name> 
<cueslookup:name key="c.title.status.authenticating">Authenticating User</cueslookup:name> 
<cueslookup:name key="c.title.status.answeringchallenge">Sending Response</cueslookup:name> 
<cueslookup:name key="c.title.status.checking">Checking Requirements</cueslookup:name> 
<cueslookup:name key="c.title.status.checkcomplete">System Check Complete</cueslookup:name> 
<cueslookup:name key="c.title.status.loggedin">NAC Process Completed</cueslookup:name> 
<cueslookup:name key="c.title.status.netaccess.none">NAC Process Completed</cueslookup:name> 
<cueslookup:name key="c.title.status.netpolicy">Network Usage Policy</cueslookup:name> 
<cueslookup:name key="c.title.status.properties">Agent Properties &#x0026; Information</cueslookup:name> 
<cueslookup:name key="c.title.status.remediating">Remediating System</cueslookup:name> 
<cueslookup:name key="c.title.status.session.expired">Session has Expired</cueslookup:name> 
<cueslookup:name key="c.title.status.update.available">Update Agent</cueslookup:name> 
<cueslookup:name key="c.title.status.update.downloading">Downloading Agent</cueslookup:name> 
<cueslookup:name key="c.title.status.update.opswat.available">Update Posture Component</cueslookup:name> 
<cueslookup:name key="c.title.status.update.opswat.downloading">Downloading Posture Component</cueslookup:name> 
<cueslookup:name key="scanning">Checking</cueslookup:name> 
<!-- <cueslookup:name key="scanningitemcomplete">Finished Checking</cueslookup:name> --> 
<cueslookup:name key="ph.about">About</cueslookup:name> 
<cueslookup:name key="ph.cancel">Cancel</cueslookup:name> 
<!-- <cueslookup:name key="ph.details">Details</cueslookup:name> --> 
<cueslookup:name key="ph.logout">Logout</cueslookup:name> 
<cueslookup:name key="title_remediating">Remediating System</cueslookup:name> 
<cueslookup:name key="title_check_conplete">System Check Complete</cueslookup:name> 
<cueslookup:name key="title_full_access_granted">Logged In</cueslookup:name> 
<cueslookup:name key="title_access_denied">Network Access Denied</cueslookup:name> 
<cueslookup:name key="tempNetAccess">Temporary Network Access</cueslookup:name> 
<cueslookup:name key="announcePleaseBePatient">Please be patient while your system is checked against the network security policy 
</cueslookup:name> 
<cueslookup:name key="bttn.accept">Accept</cueslookup:name> 
<cueslookup:name key="bttn.apply">Apply</cueslookup:name> 
<cueslookup:name key="bttn.cancel">Cancel</cueslookup:name> 
<cueslookup:name key="bttn.continue">Update Later</cueslookup:name> 
<cueslookup:name key="bttn.close">Close</cueslookup:name> 
<cueslookup:name key="bttn.detailshide">Hide Compliance</cueslookup:name> 
<cueslookup:name key="bttn.detailsshow">Show Compliance</cueslookup:name> 
<cueslookup:name key="bttn.download">Download</cueslookup:name> 
<cueslookup:name key="bttn.guestAccess">Guest Access</cueslookup:name> 
<cueslookup:name key="bttn.go2link">Go To Link</cueslookup:name> 
<cueslookup:name key="bttn.launch">Launch</cueslookup:name> 
<cueslookup:name key="bttn.login">Log In</cueslookup:name> 
<cueslookup:name key="bttn.next">Re-Scan</cueslookup:name> 
<cueslookup:name key="bttn.ok">OK</cueslookup:name> 
<cueslookup:name key="bttn.propertieshide">Hide Properties</cueslookup:name> 
<cueslookup:name key="bttn.reject">Reject</cueslookup:name> 
<cueslookup:name key="bttn.remediate">Repair</cueslookup:name> 
<cueslookup:name key="bttn.rescan">Rescan</cueslookup:name> 
<cueslookup:name key="bttn.reset">Reset</cueslookup:name> 
<cueslookup:name key="bttn.restrictedNet">Get Restricted NET access This one comes down from the network</cueslookup:name> 
<cueslookup:name key="bttn.savereport">Save Report</cueslookup:name> 
<cueslookup:name key="bttn.skip">Skip</cueslookup:name> 
<cueslookup:name key="bttn.skipao">Skip All Optional</cueslookup:name> 
<cueslookup:name key="bttn.submit">Submit</cueslookup:name> 
<cueslookup:name key="bttn.update">Update</cueslookup:name> 
<cueslookup:name key="cd.days"> 
days 
</cueslookup:name> 
<cueslookup:name key="cd.nbsp"> 
&#xA0; 
</cueslookup:name> 
<cueslookup:name key="cd.tempNetAccess.counting"> 
There is approximately %1 left until your temporary network access expires 
</cueslookup:name> 
<cueslookup:name key="cd.tempNetAccess.expired"> 
Your Temporary Network Access has Expired! 
</cueslookup:name> 
<cueslookup:name key="cd.tempNetAccessShort.counting"> 
%1 left 
</cueslookup:name> 
<cueslookup:name key="cd.tempNetAccessShort.expired"> 
Expired! 
</cueslookup:name> 
<cueslookup:name key="cd.window.counting"> 
This window will close in %1 secs 
</cueslookup:name> 
<cueslookup:name key="dp.status.fullNetAccess"> 
Full Network Access 
</cueslookup:name> 
<cueslookup:name key="dp.status.fullNetAccess.verbose"> 
Your device conforms with all the security policies for this protected 
network 
</cueslookup:name> 
<cueslookup:name key="dp.status.fullNetAccessWarn.verbose"> 
Only optional requirements are failing. 
It is recommended that you update your system at 
your earliest convenience. 
</cueslookup:name> 
<cueslookup:name key="dp.status.iprefresh.progress.verbose"> 
Refreshing IP address. Please Wait... 
</cueslookup:name> 
<cueslookup:name key="dp.status.iprefresh.complete.verbose"> 
Refreshing IP address succeeded. 
</cueslookup:name> 
<cueslookup:name key="dp.status.vlanchange.progress.verbose"> 
Connecting to protected Network. Please Wait... 
</cueslookup:name> 
<cueslookup:name key="dp.status.guestNetAccess"> 
Guest Network Access 
</cueslookup:name> 
<cueslookup:name key="dp.status.noNetAccess"> 
Network Access Denied 
</cueslookup:name> 
<cueslookup:name key="dp.status.noNetAccess.verbose"> 
There is at least one mandatory requirement failing. 
You are required to update your system before 
you can access the network. 
</cueslookup:name> 
<cueslookup:name key="dp.status.rejectNetPolicy.verbose"> 
Network Usage Terms and Conditions are rejected. You will not be 
allowed to access the network. 
</cueslookup:name> 
<cueslookup:name key="dp.status.RestrictedNetAccess"> 
Restricted Network Access granted. 
</cueslookup:name> 
<cueslookup:name key="dp.status.RestrictedNetAccess.verbose"> 
You have been granted restricted network access because your device 
did not conform with all the security policies for this protected 
network and you have opted to defer updating your system. It is recommended 
that you update your system at your earliest convenience. 
</cueslookup:name> 
<cueslookup:name key="dp.status.temporaryNetAccess"> 
Temporary Network Access 
</cueslookup:name> 
<cueslookup:name key="dp.status.temporaryNetAccess.bepatient.verbose"> 
Please be patient while your system is checked against the network security policy. 
</cueslookup:name> 
<cueslookup:name key="dp.status.pra.mandatoryfailure"> 
Performing Re-assessment 
</cueslookup:name> 
<cueslookup:name key="dp.status.pra.mandatoryfailure.verbose"> 
There is at least one mandatory requirement failing. 
You are required to update your system otherwise 
your network access will be restricted. 
</cueslookup:name> 
<cueslookup:name key="dp.status.pra.optionalfailure"> 
Performing Re-assessment 
</cueslookup:name> 
<cueslookup:name key="dp.status.pra.optionalfailure.verbose"> 
Only optional requirements are failing. 
It is recommended that you update your system at 
your earliest convenience. 
</cueslookup:name> 
<cueslookup:name key="dp.status.SessionTimeout"> 
Logged out 
</cueslookup:name> 
<cueslookup:name key="dp.status.SessionTimeout.verbose"> 
Temporary Access to the network has expired. 
</cueslookup:name> 
<cueslookup:name key="dp.status.Unauthenticated"> 
Logged out 
</cueslookup:name> 
<cueslookup:name key="dp.status.Unauthenticated.verbose"> 
&#xA0; 
</cueslookup:name> 
<cueslookup:name key="ia.status.checkcomplete"> 
Finished Checking Requirements 
</cueslookup:name> 
<cueslookup:name key="ia.status.check.inprogress"> 
Please be patient while we determine if your system is compliant with the security policy 
</cueslookup:name> 
<cueslookup:name key="ia.status.check.inprogress.01"> 
Checking %1 out of %2 
</cueslookup:name> 
<cueslookup:name key="ia.status.netpolicy"> 
Access to the network requires that you view and accept the following 
Network Usage Policy 
</cueslookup:name> 
<cueslookup:name key="ia.status.netpolicylinktxt"> 
Network Usage Policy Terms and Conditions 
</cueslookup:name> 
<cueslookup:name key="ia.status.remediate.inprogress"> 
Remediating 
</cueslookup:name> 
<cueslookup:name key="ia.status.remediate.start"> 
Please Remediate 
</cueslookup:name> 
<cueslookup:name key="ia.status.remediate.checkinprogress"> 
Checking for compliance with Requirement 
</cueslookup:name> 
<cueslookup:name key="ia.table.name"> 
Name 
</cueslookup:name> 
<cueslookup:name key="ia.table.location"> 
Location 
</cueslookup:name> 
<cueslookup:name key="ia.table.software"> 
Software 
</cueslookup:name> 
<cueslookup:name key="ia.table.software.programs"> 
program(s) 
</cueslookup:name> 
<cueslookup:name key="ia.table.update"> 
Update 
</cueslookup:name> 
<cueslookup:name key="ia.table.locationcode.nochange"> 
Do not change current setting 
</cueslookup:name> 
<cueslookup:name key="ia.table.locationcode.notifybeforedownload"> 
Notify before download 
</cueslookup:name> 
<cueslookup:name key="ia.table.locationcode.notifybeforeinstall"> 
Notify before install 
</cueslookup:name> 
<cueslookup:name key="ia.table.locationcode.scheduledinstallation"> 
Download and installation 
</cueslookup:name> 
<cueslookup:name key="ia.table.locationcode.forcenotifybeforedownload"> 
Change to notify before download 
</cueslookup:name> 
<cueslookup:name key="ia.table.locationcode.forcenotifybeforeinstall"> 
Change to notify before installation 
</cueslookup:name> 
<cueslookup:name key="ia.table.locationcode.forcescheduledinstall"> 
Change to download and installation 
</cueslookup:name> 
<cueslookup:name key="ia.table.description"> 
Description 
</cueslookup:name> 
<cueslookup:name key="scs.table.title"> 
Security Compliance Summary 
</cueslookup:name> 
<cueslookup:name key="scs.table.header1.scan_rslt"> 
Scan Result 
</cueslookup:name> 
<cueslookup:name key="scs.table.header1.pack_name"> 
Requirement Name 
</cueslookup:name> 
<cueslookup:name key="scs.table.header1.pack_details"> 
Requirement Description - Remediation Suggestion 
</cueslookup:name> 
<cueslookup:name key="scs.table.data.mandatory"> 
Mandatory 
</cueslookup:name> 
<cueslookup:name key="scs.table.data.optional"> 
Optional 
</cueslookup:name> 
<cueslookup:name key="scs.table.data.pass"> 
Passed 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_optional_download"> 
Please download and install the optional software before accessing the network 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_mandatory_download"> 
Please download and install the required software before accessing the network 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_optional_launch"> 
Please launch the optional remediation program(s) before accessing the network 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_mandatory_launch"> 
Please launch the required remediation program(s) before accessing the network 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_optional_opswat_av"> 
Please update the virus definition file of the specified antivirus software before accessing the network (optional) 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_mandatory_opswat_av"> 
Please update the virus definition file of the specified antivirus software before accessing the network (required) 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_optional_opswat_as"> 
Please update the spyware definition file of the specified anti-spyware software before accessing the network (optional) 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_mandatory_opswat_as"> 
Please update the spyware definition file of the specified anti-spyware software before accessing the network (required) 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_optional_win_update"> 
Please download and install the optional windows updates before accessing the network 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_mandatory_win_update"> 
Please download and install the required windows updates before accessing the network 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_auto_launch_prog"> 
Launching Remediation Program(s)... 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_auto_launch_url"> 
Launching Remediation URL... 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_auto_opswat_av"> 
Updating Virus Definition... 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_auto_opswat_as"> 
Updating Spyware Definition... 
</cueslookup:name> 
<cueslookup:name key="ia.rem_inst_auto_win_update"> 
Launching Windows auto Update(s)... 
</cueslookup:name> 
<cueslookup:name key="ia.rem_launch_downloaded_file"> 
Downloaded at %1. %br% Please open this folder &#x0026; double-click executable file to install the required software. 
</cueslookup:name> 
<cueslookup:name key="discoveryhost.label"> 
Discovery Host 
</cueslookup:name> 
<cueslookup:name key="properties.table.title"> 
List of Antivirus &#x0026; Anti-Spyware Products Detected by the Agent 
</cueslookup:name> 
<cueslookup:name key="properties.table.header1.index"> 
No. 
</cueslookup:name> 
<cueslookup:name key="properties.table.header1.description"> 
Description 
</cueslookup:name> 
<cueslookup:name key="properties.table.header1.value"> 
Value 
</cueslookup:name> 
<cueslookup:name key="properties.table.data.product_type"> 
Product Type 
</cueslookup:name> 
<cueslookup:name key="properties.table.data.product_name"> 
Product Name 
</cueslookup:name> 
<cueslookup:name key="properties.table.data.product_version"> 
Product Version 
</cueslookup:name> 
<cueslookup:name key="properties.table.data.def_version"> 
Definition Version 
</cueslookup:name> 
<cueslookup:name key="properties.table.data.def_date"> 
Definition Date 
</cueslookup:name> 
<cueslookup:name key="reboot.mandatory.001"> 
Mandatory System Reboot Required 
</cueslookup:name> 
<cueslookup:name key="reboot.optional.001"> 
You need to reboot your system in order for the changes to take effect. 
</cueslookup:name> 
<cueslookup:name key="rem.error.001"> 
Unable to remediate particular requirement 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_access_denied"> 
The remediation you are attempting is reporting an access denied error. This is usually due to a privilege issue. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_buffer_too_small"> 
The remediation you are attempting has failed with an internal error. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_elevation_required"> 
The remediation you are attempting requires elevation. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_failed"> 
The remediation you are attempting had a failure. If the problem persists contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_internal_error"> 
The remediation you are attempting has reported an internal error. If this problem persists please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_not_implemented"> 
The remediation you are attempting is not implemented for this product. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_not_supported"> 
The remediation you are attempting is not supported for this product. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_update_faile"> 
The AV/AS update has failed. Please try again and if this message continues to display contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_update_failed_due_to_network"> 
The AV/AS update failed due to a networking issue. Please try again and if this message continues to display contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.av_timeout"> 
The remediation you are attempting has timed out waiting for the operation to finish. If this continues please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.file_dist_size_error"> 
The size of the downloaded file does not match the package! Please discard downloaded file and check with your administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.file_is_not_signed"> 
The file that has been requested was not digitally signed. Please try again and if this message continues to display contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.file_save_location_error"> 
The location for the file to be saved to can not be written. Please choose a different location. 
</cueslookup:name> 
<cueslookup:name key="rem.error.http_file_not_found"> 
The requested file is not found. Please try again and if this problem persists, contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.launch_file_not_found"> 
The file that has been requested could not be launched either because it could not be found or there was a problem launching it. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.malformed_URL"> 
The file that is trying to be downloaded has an incorrect URL. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.network_error"> 
There has been a network error, please try the remediation again. If this message continues to be seen contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.update_fail_for_non_admin"> 
The remediation you are trying to do can not be accomplished at your user level. Please contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="rem.error.wsus_search_failure"> 
The WSUS search failed. This is probably due to a network issue. Please try again and if this message continues to display contact your system administrator. 
</cueslookup:name> 
<cueslookup:name key="server.error.generic"> 
Agent encountered problems logging user 
</cueslookup:name> 
<cueslookup:name key="server.error.255"> 
Network Error: NAC Server could not establish a secure connection to NAC Manager. 
This could be due to one or more of the following reasons: 
1) NAC Manager certificate has expired or 
2) NAC Manager certificate cannot be trusted or 
3) NAC Manager cannot be reached or 
4) NAC Manager is not responding 
Please report this to your network administrator. 
</cueslookup:name> 
<cueslookup:name key="server.error.5000"> 
Invalid provider name 
</cueslookup:name> 
<cueslookup:name key="server.error.5001"> 
Failed to add user to online list 
</cueslookup:name> 
<cueslookup:name key="server.error.5002"> 
Server communication error 
</cueslookup:name> 
<cueslookup:name key="server.error.5003"> 
Invalid username or password 
</cueslookup:name> 
<cueslookup:name key="server.error.5004"> 
Unknown user 
</cueslookup:name> 
<cueslookup:name key="server.error.5005"> 
Account expired 
</cueslookup:name> 
<cueslookup:name key="server.error.5006"> 
Account currently disabled 
</cueslookup:name> 
<cueslookup:name key="server.error.5007"> 
Exceed quota limit 
</cueslookup:name> 
<cueslookup:name key="server.error.5008"> 
Insufficient Clean Access packages installed 
</cueslookup:name> 
<cueslookup:name key="server.error.5009"> 
Access to network is blocked by the administrator 
</cueslookup:name> 
<cueslookup:name key="server.error.5010"> 
Vulnerabilities not fixed 
</cueslookup:name> 
<cueslookup:name key="server.error.5011"> 
This client version is old and not compatible. Please login from web browser to see the download link for the new version. 
</cueslookup:name> 
<cueslookup:name key="server.error.5012"> 
Network policy is not accepted 
</cueslookup:name> 
<cueslookup:name key="server.error.5013"> 
Invalid switch configuration 
</cueslookup:name> 
<cueslookup:name key="server.error.5014"> 
Too many users using this account 
</cueslookup:name> 
<cueslookup:name key="server.error.5015"> 
Invalid session 
</cueslookup:name> 
<cueslookup:name key="server.error.5016"> 
Null session 
</cueslookup:name> 
<cueslookup:name key="server.error.5017"> 
Invalid user role 
</cueslookup:name> 
<cueslookup:name key="server.error.5018"> 
Invalid login page 
</cueslookup:name> 
<cueslookup:name key="server.error.5019"> 
Encoding failure 
</cueslookup:name> 
<cueslookup:name key="server.error.5020"> 
A security enhancement is required for your Agent. Please upgrade your Agent or contact your network administrator. 
</cueslookup:name> 
<cueslookup:name key="server.error.5021"> 
Can not find server reference 
</cueslookup:name> 
<cueslookup:name key="server.error.5022"> 
User role currently disabled 
</cueslookup:name> 
<cueslookup:name key="server.error.5023"> 
Authentication server is not reachable 
</cueslookup:name> 
<cueslookup:name key="server.error.5024"> 
Agent user operating system is not supported 
</cueslookup:name> 
<cueslookup:name key="server.error.generic_emergency"> 
The Agent has encountered an unexpected error and is restarting. 
</cueslookup:name> 
<cueslookup:name key="server.error.http_error"> 
Clean Access Server is not available on the network. 
</cueslookup:name> 
<cueslookup:name key="server.error.nw_interface_chg"> 
Authentication interrupted due to network status change. Press OK to retry. 
</cueslookup:name> 
<cueslookup:name key="server.error.svr_misconfigured"> 
Clean Access Server is not properly configured. 
</cueslookup:name> 
<cueslookup:name key="server.clarification.generic_emergency"> 
Please contact your administrator if the problem persists. 
</cueslookup:name> 
<cueslookup:name key="announce.savingreport"> 
Saving Report 
</cueslookup:name> 
<cueslookup:name key="announce.savingreport.failed"> 
Unable to save report 
</cueslookup:name> 
<cueslookup:name key="announce.cancelremediationack"> 
Clicking Cancel may change your network connectivity and interrupt download or required updates.<p> Do you want to continue?</p> 
</cueslookup:name> 
<cueslookup:name key="announce.dismiss.default"> 
Dismiss to continue 
</cueslookup:name> 
<cueslookup:name key="announce.logoutconfirm"> 
Successfully logged out from the network! 
</cueslookup:name> 
</cueslookup:appstrings> 

Note	There is no limit to the number of characters you can use for the customized text. However, Cisco recommends restricting the length so that these fields do not take up too much space in the resulting customized login screen as it appears on the client.

<cueslookup:name key="dp.status.fullNetAccess">Full Network Access</cueslookup:name> 
<cueslookup:name key="dp.status.fullNetAccess.verbose">Your device conforms with all the security policies for this protected network</cueslookup:name> 
<cueslookup:name key="dp.status.fullNetAccessWarn.verbose">Only optional requirements are failing. It is recommended that you update your system at your earliest convenience.</cueslookup:name> 
<cueslookup:name key="dp.status.iprefresh.progress.verbose">Refreshing IP address. Please Wait ...</cueslookup:name> 
<cueslookup:name key="dp.status.iprefresh.complete.verbose">Refreshing IP address succeeded.</cueslookup:name> 
<cueslookup:name key="dp.status.vlanchange.progress.verbose">Connecting to protected Network. Please Wait ...</cueslookup:name> 
<cueslookup:name key="dp.status.guestNetAccess">Guest Network Access</cueslookup:name> 
<cueslookup:name key="dp.status.noNetAccess">Network Access Denied</cueslookup:name>
<cueslookup:name key="dp.status.noNetAccess.verbose">There is at least one mandatory requirement failing. You are required to update your system before you can access the network.
</cueslookup:name><cueslookup:name key="dp.status.rejectNetPolicy.verbose">Network Usage Terms and Conditions are rejected. You will not be allowed to access the network.</cueslookup:name> 
<cueslookup:name key="dp.status.RestrictedNetAccess">Restricted Network Access granted.</cueslookup:name> 
<cueslookup:name key="dp.status.RestrictedNetAccess.verbose">You have been granted restricted network access because your device did not conform with all the security policies for this protected network and you have opted to defer updating your system. It is recommended that you update your system at your earliest convenience.</cueslookup:name> 
<cueslookup:name key="dp.status.temporaryNetAccess">Temporary Network Access</cueslookup:name> 
<cueslookup:name key="dp.status.temporaryNetAccess.bepatient.verbose">Please be patient while your system is checked against the network security policy.</cueslookup:name>
<cueslookup:name key="dp.status.pra.mandatoryfailure">Performing Re-assessment</cueslookup:name> 
<cueslookup:name key="dp.status.pra.mandatoryfailure.verbose">There is at least one mandatory requirement failing. You are required to update your system otherwise your network access will be restricted.</cueslookup:name> 
<cueslookup:name key="dp.status.pra.optionalfailure">Performing Re-assessment</cueslookup:name> 
<cueslookup:name key="dp.status.pra.optionalfailure.verbose">Only optional requirements are failing. It is recommended that you update your system at your earliest convenience.</cueslookup:name> 
<cueslookup:name key="dp.status.SessionTimeout">Logged out</cueslookup:name> 
<cueslookup:name key="dp.status.SessionTimeout.verbose">Temporary Access to the network has expired.</cueslookup:name> 
<cueslookup:name key="dp.status.Unauthenticated">Logged out</cueslookup:name> 
<cueslookup:name key="dp.status.Unauthenticated.verbose"> </cueslookup:name> 

This is one of the files that is required in your Agent screen customization package, allows you to customize the logo, fields, and message text contained in a Cisco NAC Agent dialog, like the Properties screen, to suit your specific Windows client network access requirements.

Before you can complete your Agent screen customization package, you must construct a suitable updateFeed.xml XML descriptor file. Use the following example as a template to set up the updateFeed.xml descriptor file required for your customization package.

<?xml version="1.0" encoding="utf-8"?> 
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:update="http://www.cisco.com/cpm/update/1.0"> 
<title>Provisioning Update</title> 
<updated>2011-12-21T12:00:00Z</updated> 
<id>https://www.cisco.com/web/secure/pmbu/provisioning-update.xml</id> 
<author> 
<name>Cisco Support</name> 
<email>support@cisco.com</email> 
</author> 
<!-- Custom Branding --> 
<entry> 
<id>http://foo.foo.com/foo/AgentCustomizationPackage/1/1/1/7</id> 
<title>Agent Customization Package</title> 
<updated>2010-06-07T12:00:00Z</updated> 
<summary>This is EF Agent Customization Package 1.1.1.7</summary> 
<link rel="enclosure" type="application/zip" href="brand-win.zip" length="18884" /> 
<update:type>AgentCustomizationPackage</update:type> 
<update:version>1.1.1.7</update:version> 
<update:os>WINDOWS_ALL</update:os> 
</entry> 
</feed> 

<?xml version="1.0" ?>
<cfg>
   <VlanDetectInterval>0</VlanDetectInterval>
   <RetryDetection>3</RetryDetection>
   <PingArp>0</PingArp>
   <PingMaxTimeout>1</PingMaxTimeout>
   <EnableVlanDetectWithoutUI>0</EnableVlanDetectWithoutUI>
   <SignatureCheck>0</SignatureCheck>
   <DisableExit>0</DisableExit>
   <PostureReportFilter>displayFailed</PostureReportFilter>
   <BypassSummaryScreen>1</BypassSummaryScreen>
   <LogFileSize>5</LogFileSize>
   <DiscoveryHost></DiscoveryHost>
   <DiscoveryHostEditable>1</DiscoveryHostEditable>
   <Locale>default</Locale>
   <AccessibilityMode>0</AccessibilityMode>
   <SwissTimeout>1</SwissTimeout>
   <HttpDiscoveryTimeout>30</HttpDiscoveryTimeout>
   <HttpTimeout>120</HttpTimeout>
   <ExceptionMACList></ExceptionMACList>
   <GeneratedMAC></GeneratedMAC>
   <AllowCRLChecks>1</AllowCRLChecks>
   <DisableL3SwissDelay>0</DisableL3SwissDelay>
   <ServerNameRules></ServerNameRules>
</cfg>

Note	This file also contains two static (that is, uneditable by the user or Cisco ISE administrator) “AgentCfgVersion” and “AgentBrandVersion” parameters used to identify the current version of the agent profile and agent customization file, respectively, on the client.

For client machines, configure which agent type, compliance module, agent customization package, and/or profile to make available and provision for users to download and install on the client machine.

Employees can connect their personal devices to the network directly using native supplicants, which are available for Windows, Mac OS, iOS, and Android devices. For personal devices, specify which Native Supplicant configuration to make available and provision on the registered personal device.