Enterprise Administration Guide › Managing Policies Centrally › Variables › How an Endpoint Resolves Variables

How an Endpoint Resolves Variables

Variables let you deploy the same policy to endpoints that have different configurations and different operating systems. The following process explains how a CA Access Control endpoint resolves variables in a policy after you have created and deployed the policy:

1. When policyfetcher fetches the policy, CA Access Control checks that the variables in the policy are defined in the policy or in the CA Access Control database. One of the following occurs:
   • If the variable is not defined in the policy or in the database, CA Access Control changes the policy status to Deploy Pending.

     Note: To deploy the policy, you must define the undefined variables and redeploy the policy.

   • If the variable is defined in the policy or in the database, CA Access Control compiles the policy and enforces the rules it contains.
2. Every heartbeat, policyfetcher checks if a variable value has changed in the CA Access Control database. One of the following occurs:
   • If no variable values have changed, policyfetcher repeats Step 2.
   • If a variable value has changed, CA Access Control changes the policy status to Out of Sync for any policy on the endpoint that uses the changed variable.

     Note: To clear the Out of Sync status for the policy, you must redeploy the policy.