Cisco ASA Series User Manual

1-76
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Supporting a Zone Labs Integrity Server
• Configuring Integrity Server Support, page 70-76
Overview of the Integrity Server and ASA Interaction
The VPN client software and the Integrity client software are co-resident on a remote PC. The following
steps summarize the actions of the remote PC, ASA, and Integrity server in the establishment of a session
between the PC and the enterprise private network:
1. The VPN client software (residing on the same remote PC as the Integrity client software) connects
to the ASA and tells the ASA what type of firewall client it is.
2. After the ASA approves the client firewall type, the ASA passes Integrity server address information
back to the Integrity client.
3. With the ASA acting as a proxy, the Integrity client establishes a restricted connection with the
Integrity server. A restricted connection is only between the Integrity client and the Integrity server.
4. The Integrity server determines if the Integrity client is in compliance with the mandated security
policies. If the Integrity client is in compliance with security policies, the Integrity server instructs
the ASA to open the connection and provide the Integrity client with connection details.
5. On the remote PC, the VPN client passes connection details to the Integrity client and signals that
policy enforcement should begin immediately and the Integrity client can enter the private network.
6. After the VPN connection is established, the Integrity server continues to monitor the state of the
Integrity client using client heartbeat messages.
Note The current release of the ASA supports one Integrity server at a time, even though the user interfaces
support the configuration of up to five Integrity servers. If the active Integrity server fails, configure
another one on the ASA and then reestablish the VPN client session.
Configuring Integrity Server Support
This section describes an example procedure for configuring the ASA to support the Zone Labs Integrity
servers. The procedure involves configuring address, port, connection fail timeout and fail states, and
SSL certificate parameters.
To configure the Integrity server, perform the following steps:
Command Purpose
Step 1
zonelabs-Integrity server-address {hostname1 |
ip-address1}
Example:
hostname(config)# zonelabs-Integrity server-address
10.0.0.5
Configures an Integrity server using the IP address
10.0.0.5.
Step 2
zonelabs-integrity port port-number
Example:
hostname(config)# zonelabs-integrity port 300
Specifies port 300 (the default port is 5054).

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English