This rule set will always be the the first set to be executed. Other rule sets are called from here. is_location_enforced Unenforced Devices end_session Device Settings off always in production Move to Production always in quarantine Always in Quarantine Device Enforcement Quarantine The default action is to quarantine. This rule set serves as an example for what might be done to launch actions based on audit results of a device not under enforcement (i.e. audits run on devices that are not on an enforced port). nac_request was_immediate_run immediate Quick Scan Default The "#{health}" health verification against the "#{last_testset}" audit test set has failed. This rule set is where specific device settings should be managed (e.g. setting the production zone). production_zone production_zone default This rule set is where enforcement of devices is managed. Allow a device with good health back on immediately if the device was online recently. last_online_time 0 00:30:00 last_audit_time 0 12:30:00 Default Move to Production background Quick Scan 720 Wait for MAC/IP corporate-agent corporate-agent-webauth Require Lockdown Agent background was_immediate_run immediate Quick Scan corporate-agent-webauth corporate-webauth Require Authentication Default Move to Production (user) Default Move to Production Move to Quarantine nap This rule set can be used to ensure a device is finally moved into its production network. in_production agent_on info The Lockdown Enforcer has now placed you in Production. This rule set requires a Lockdown Agent only for the audit. agent_present agent_off Quarantine The Lockdown Agent is required before access to the network is allowed. background was_immediate_run immediate Quick Scan Quarantine An audit is being run to determine the health of your system. agent_present Default This rule set can be used when a MAC and an IP address is required. mac ip Quarantine Waiting to learn a MAC and an IP address. This rule set can be used to require authentication. is_authenticated Quarantine Authentication is required. prev_match #{dev} has authenticated as #{user} via #{auth_type} This rule set can be used as a replacement for the Device Enforcement Rule Set. This one will still run a Quick Scan, but will allow devices on to the network right away and only quarantine them if the audit is failed. Wait for MAC/IP was_immediate_run immediate Quick Scan was_immediate_run Default Move to Quarantine Move to Production This rule set can be used as a replacement for the Device Enforcement Rule Set. This one will still run a Quick Scan, but will allow devices on to the network right away if they have audit results that pass. Wait for MAC/IP last_testset immediate Quick Scan last_testset Default Move to Quarantine Move to Production This is an example of how policy might be enforced for a particular conference room based on who has logged in. This can be used as a template to be called from the Device Enforcement Rule Set just after the rule for learning the IP. Note that this Rule Set makes use of some special names that either need to be in place or this set should be modified to use different values. Conference Room ruleset Require Authentication user_groups Quarantine Waiting to learn user group membership for #{user}. full Executives production_zone Executive VLAN Allow Last Audit Passed Employees Allow Before Audit Note that this rule will fall through to the remainder of the policy. The only change here is to assign the device to a special VLAN. Guests production_zone Guest VLAN This rule set can be used to require the Lockdown Agent. agent_present Quarantine The Lockdown Agent is required before access to the network is allowed. This rule set can be used to ensure a device is finally moved into its production network. in_production agent_on info The Lockdown Enforcer has now placed you in Production. alice bob full donna guest full Quarantine The "#{health}" health verification against the "#{last_testset}" audit test set has failed. Quarantine Device #{dev} is a member of the Always in Quarantine group.