Cyber Sanbower

Background: The most misunderstood topic of the configuration of NACA is Managed Subnets. Every time I get a call about a LAN deployment, which is not working, the first thing I say is "Managed Subnets!". Hopefully, by reading this you will start to understand the taboo term and know when/where to configure Managed Subnets. Managed Subnets Theory: "For all CAS modes in L2 deployments (Real-IP/Virtual Gateway) when configuring additional subnets, you must configure Managed Subnets in the CAS so that the CAS can send ARP queries with appropriate VLAN IDs for client machines on the untrusted interface." The first question you must ask during deployment is "are there more than one VLAN on the untrusted side of the CAS?" If so, you need to give the CAS "logical interfaces" so that the CAS can "manage" those vlans/subnets. The best way to think about managed subnets is to think about a "router on a stick" deployment; A single interf...

Cisco Posted a new Configuration Guide on how to use LDAP to map users to roles. This is relevant for any deployment integrating with LDAP as an auth server (e.g. Active Directory) or performing LDAP lookup with AD SSO. NAC(CCA) 4.x: Map Users to Certain Roles Using LDAP Configuration Example Make sure you check it out before your next LDAP auth server deployment.

Finally after many years the first Cisco NAC Appliance book will be released in this coming August! A lot of very good engineers have contributed to this book, including the NACA TMEs! It is definately going to be something worth picking up and reading! Cisco NAC Appliance: Enforcing Host Security with Clean Access Book Description: The ultimate reference guide for the Cisco NAC (Network Access Control) Appliance with easy-to-follow guides to major security applications - Learn how Network Admission Control can make your network more secure - Prevent security breaches by checking for and enforcing a host security policy at the network edge - Master the design, configuration, deployment, and troubleshooting of the NAC Appliance solution Cisco NAC Appliance from Cisco Press presents an overview of real world Cisco NAC Appliance (formerly known as Clean Access) deployment scenarios. The book provides best practices for communicating to the user community before deploying the NAC Appliance...

Background: Many organizations require personal firewall software to be run on clients connecting into their network as a part of their security policy. This post explores how to create custom checks to enforce the use of personal firewall software on connecting clients. This is one of the most requested custom checks I receive and hopefully you will find it benefit. Create Checks and Rules: For this example, I am going to show how to create custom checks for 3 different types of Personal Firewall Applications. All of this software is free and can be downloaded. To create a custom check you must go to: Device Management – Clean Access – Clean Access Agent – Rules – New Check Windows XP Firewall Check The most reliable way I have found to check for XP firewall is to use a Registry Check looking for the following Registry Value: Registry Key: HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Registry Value: EnableFirewa...

Background: Operations Acceptance of NACA is very important for a successful deployment. If Staff does not accept the solution than it will not be utilized to its capabilities or be maintained. This post is all about educating staff in order to ensure a successful deployment. Introducing NACA to the Operations Staff: NACA has to become an integral part of network and security operations in order to have a successful deployment. The following are some of the topics that Network Operations must be informed about: Clean Access Servers ( CASs ) act as an extension to the routers and switches in the network This causes network operations the need to understand how the CASs reside in the data path of users In an Out-of-Band ( OOB ) Deployment, netops has to understand the integration between the Clean Access Manager (CAM) and all access switches This requires the staff to have knowledge about SNMP Servers & SNMP Traps Security Operations have many topics that they must know abou...

Background: NAC Appliance is a product that can looks very easy to install. For most people, this can be the start of many problems. It is important to realize that the product is made to be easy and that level can be obtained, but a lot of hours are required to realize the Ins and Outs of NACA. This post is all about the misconceptions about what level of knowledge a deployment engineer should have, as well as the steps engineers can do to get to that level. Understanding the Learning Curve: NAC Appliance is a product that does deploy very quickly. For smaller deployments, it can be stood up and working in just hours, but this is for engineers that have taken the time to understand it. The more hours you spend looking into the CAM GUI the easier things get. This product gets confusing in a few instances: Customization of Posture Assessment and Remediation Going above and beyond the normal of Windows HotFixes and AV Installation/Definitions Truly enforcing security policy with CCA ...

Background: User Acceptance of NACA is the #1 most important consideration that must be made during a deployment. This post should hopefully help you understand the best practices to make users "accept" the solution. Messaging the Solution to Users: In order for users to not get really upset about the solution, you MUST message the plans of turning on the NACA solution. If you do not message this information to users they will have no idea what hit them and you can rest assure that their boses or parents(in the EDU space) will hear about it and you will be getting A LOT of complaints. Along with these complaints will be the complete dislike of the solution before they have even used it. Messaging is simple and can be performed by using: - Posters/Banners - E-mail - Formal Letters The content on the messaging needs to include: - Benefits of CCA for the end-user & organization as a whole - Reasons the organization is deploying the solution - Time frames of deployment - How ...