Select Agent Enforcement from the drop-down list.

Enter the name of the enforcement profile.

Optionally, enter a description of the enforcement profile (recommended).

This field is populated automatically with type Agent.

By default, this field is disabled. It is enabled only when RADIUS type is specified.

Select a device group from the drop-down list. The list displays all configured device groups.

All configured device groups are listed in the Configuration > Network > Device Groups page. After you add one or more device groups, you can select a group and take one of the following actions:

To delete the selected Device Group List entry, click Remove.

To see the device group parameters, click View Details.

To change the parameters of the selected device group, click Modify.

To bounce the network interface and terminate the network connection, set the value to True.

Enter the message that needs to be displayed on the endpoint.

Configure the agent session timeout interval to periodically evaluate the endpoint's health.

OnGuard Agent performs health checks after the specified session timeout interval and updates the health status of the endpoint in Policy Cache.

You can specify the session timeout interval from 60 to 600 seconds. The default value is 0.

NOTE: Setting the lower value for the session timeout interval results in numerous authentication requests in the Access Tracker page.

Specify the health-check interval value in hours for different Agent Enforcement Profiles for different users. The allowed range is 0 to 1000 hours.

NOTE: The value of the Policy result cache timeout parameter (found in Server Configuration > Cluster-wide Parameters) must be greater than the highest value of all the Health Check Interval (in hours) values.

Note the following information:

You can set the Health Check Interval if OnGuard mode is set to Health only.

This parameter is valid only for wired and wireless interface types.

This parameter is not applicable for the OnGuard Dissolvable Agent, VPN, and Other interface types.

To hide the Retry button in the OnGuard Agent, click the check box to set the value to True.

To hide the Logout button in the OnGuard Agent, click the check box to set the value to True.

To hide all Quit options in OnGuard Agent, click the check box to set the value to True.

When Bounce Delay is configured, the network interface is bounced after the specified delay.

Click the check box to set this attribute to True and enable the OnGuard Agent Remediation User Interface for Custom Scripts (for related information, refer to the Custom User Interface parameter in Creating OnGuard Custom Web Pages).

Allows you to specify the V4 OnGuard Detection SDK Software Developer Toolkit; Software tools and programs used to develop software for a particular platform. (for related information, see Upgrading From OnGuard Plugin Version 1.0 to 2.0).

When this option is enabled and a new version of OnGuard Agent Library is available on the Policy Manager server, Policy Manager OnGuard Agent automatically downloads and installs the new version of OnGuard Agent Library from the Policy Manager server. OnGuard modules, including detection libraries for client programs (V4 SDK Software Developer Toolkit; Software tools and programs used to develop software for a particular platform.), can be upgraded without having to upgrade your Policy Manager or OnGuard installations (for more information, see OnGuard Agent Library Updates).

To have OnGuard show the user posture results in a web page when the client is Unhealthy, click the check box to set this attribute to True.

To enable OnGuard Agent to check for the presence of an "evil twin" with a wired interface, click the check box to set this attribute to True.

When OnGuard Agent detects an evil twin on a wired interface, it sends a WebAuth request with the Host:EvilTwin attribute having the value "MayExist,” indicating that an evil twin may exist.

The Host:EvilTwin attribute is available in Service rules, Role Mapping, and Enforcement profiles. For more information, see Evil Twin Detection with OnGuard.