Cyber Sanbower

If everyone out there has not heard yet, there is a spring 2008 chalktalk series going on currently. The chalk talks are very technical and can give everyone great insight into the topics discussed. March 13th - Cisco NAC Deployment Methodologies March 20th - Troubleshooting Cisco NAC Appliance March 27th - NAC Profiler Best Practices All can be seen at 10am PDT at http://premium.meetingplace.net with meeting ID 434343 Also, Robb Boyd and the TechWise TV team posted a podcast on Troubleshooting Cisco NAC Appliance. It features "rockstar" Prem Ananthakrishnan, one of the great TMEs from the NAC BU. NAC Troubleshooting Podcast

There is a new TechWiseTV episode about to be taped, focusing on Cisco NAC Appliance and the producers are looking for feedback as to what the episode should focus on. The main presenter will be Alok Agrawal, one of the Technical Marketing Engineers from the Cisco NAC Business Unit. If you have never seen TechWiseTV, it is a highly technical show focusing on getting answers to the tough questions. I can promise that if enough of you want a topic discussed that Alok will definately be put on the spot to give you an answer. So please visit their website and start posting about what you are interested in hearing explained: http://www.mytechwisetv.com/page/30+Network+Admission+Control The following is a draft of the topics discussed: Proposed Segmentation: Segment 1: NAC Foundational Concepts - What is it, why do we need it, why now? Where does 802.1x fit, what problems can be solved here, etc. Posture Assesment - more than just AV and Spyware Client vs. Clientless, Inband vs. Out of Band...

Background: One of the much waited for features in the NAC 4.1(3) release is the NAC Web Agent. " The Cisco NAC Web Agent provides temporal vulnerability assessment for client machines. Users launch the Cisco NAC Web Agent executable, which installs the Web Agent files in a temporary directory on the client machine via ActiveX control or Java applet. When the user terminates the Web Agent session, the Web Agent logs the user off of the network and their user ID disappears from the Online Users list." In short, it is a temporary agent that gives the ability to have a detailed posture assessment performed on a machine that it is not desired to or can't install software on. Figure 1 – Cisco NAC Web Agent The Spotlight: The NAC Web Agent is a great addition to the capabilities of Cisco NAC Portfolio. The following is a functionality to agent type(CAA vs. Web Agnet) comparison. It includes some of the major benefits of each agent type to give everyone a better idea of where t...

4.1.3 is available and you can download it here: Cisco NAC Appliance Software Download Page Requires a valid Smartnet contract in order to download 4.1.3 Release Notes As with all NAC Upgrades, the release notes are extremely important! 4.1.3 CAM Installation & Configuration Guide 4.1.3 CAS Installation & Configuration Guide Enhancements in Release 4.1(3) General Enhancements • Cisco NAC Web Agent • Support for Clients with Multiple Active NICs • Clean Access Server HA Heartbeat Link Enhancement • Clean Access Manager HA Configuration and Heartbeat Link Enhancements • Guest User Login and Registration Enhancements • LDAP Authentication Enhancement • Clean Access Server and WSUS Interaction Enhancement • Agent Restricted User Access Enhancement • Device Filter List Display and Import/Export Enhancement • Agent Report Information Display and Export Enhancement • VPN SSO Login Enhancement • Syslog Configuration Enhancement • Debug Log...

Bulletin http://www.cisco.com/en/US/products/ps6128/prod_bulletin0900aecd806f3235.html Data Sheet http://www.cisco.com/en/US/products/ps6128/products_data_sheet0900aecd806e98c9.html Q&A http://www.cisco.com/en/US/products/ps6128/products_qanda_item0900aecd806f525a.shtml Release Notes 1.0.0 http://www.cisco.com/en/US/docs/security/nac/guestserver/release_notes/10/gsrn100.html Configuration Guide 1.0.0 http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/10/nacguestserver.html

Background: Cisco NAC Profiler is an OEM software from Great Bay Software’s Beacon product( Read more ). The basis and need for NAC Profiler is to secure Non-Responsive Hosts(NRHs). This is performed by using state of the art Endpoint Profiling and Behavior Monitoring technologies. Endpoint profiling is defined as recording a network endpoint’s observable behaviors and analyzing identifiable characteristics of the endpoint in order to classify it as belonging to a particular group (Profile) and to assess each endpoint’s ability in a certain sphere. That certain sphere could be an endpoint’s ability to participate in a given authentication or Cisco NAC Appliance as an example. In essence, Endpoint Profiling is best described as behavior-based characterization of endpoints for the purpose of identifying and grouping together those that are similar in function, capability or other defining characteristics. Behavior Monitoring is the ability to ensure endpoints are behaving in a wa...

Background: BigFix ( www.bigfix.com ) is one of the many remediation software solutions available that can work with NAC for a better end user experience. BigFix can enforce that a client has the proper software, patches, and updates on a device. This sounds a bit like NAC, but the missing puzzle piece is how to enforce that bigfix is really on the connecting device and doing its job? This posting will talk about some of checks that may be created to enforce the presence and compliance of bigfix on a device connecting into the network. ***Please note that there are many ways of looking for installed/running software and it is best practice to check in two different manners(e.g. service and application check), but to keep this post more straightforward, I will only shows one of the checks. Is BigFix Installed: In order to properly assess if BigFix is installed, the following checks if the BESClient is actually there. Check Category: File Check Check Type: File Existence Check Name: BigF...