Cyber Sanbower

Background: The Cisco NAC Manager is the brain of the Cisco NAC solution. All configuration is stored in a database which makes the solution scalable. With that said, a crucial step in any deployment is developing a backup plan to ensure that if the NAC Manager or Failover Pair fails(Hardware failure, database corruption, administrator configuration mistake, fire, flood, sinkhole, etc.) the database can be restored and everything will be back up and working! What gets backed up: Everything that is stored in the database gets backed up. The following is a list of items that get backed up: o Clean Access Server Configuration information (DHCP, Managed Subnets, VLAN Mapping, Static Routes, filters, etc.) o Filters (Device Filters, Subnet Filters) o Posture Assessment (Checks, Rules, Requirements,etc) o Switch Management o User Management (User Roles, Auth Servers, User Pages, Admin Users) o Reports o Licenses What doesn't get backed up: The less talked ...

On June 9th, Cisco posted an update to NAC Guest Server. Version 1.1.1 comes with a few new features: Guest Role Support Guest Role Support provides the ability for Sponsors to create guest accounts with different privileges. This includes provisioning into different roles on the Clean Access Manager, returning different RADIUS attributes to RADIUS clients or only allowing access from specified networks. Additional NTP Server The 1.1.1 release introduces the ability to configure two NTP servers instead of a single NTP server in 1.1.0. FTP Backup Directory The 1.1.1 release allows a directory to be specified as part of the scheduled FTP backup, prior versions placed the backup in the default directory of the FTP user account. As with all NAC related upgrades make sure to read the RELEASE NOTES before upgrading ! The NAC Guest Server Installation & Configuration Guide 1.1.1 can be used for reference of the new features. Finally to download the new version go to the NAC Guest Serve...

Cisco posted two new Configuration Guides: NAC: LDAP over SSL on the Clean Access Manager (CAM) This example will walk you through using SSL with your LDAP Auth Server. NAC: LDAP Integration with ACS Configuration Example This example will explain how to use Cisco NAC Profiler for MAC Auth Bypass(MAB) for 802.1X deployments. To see all the previous Configuration Examples and TechNotes

Background: One question that many people ask is how to deal with IP Phones during your NAC Deployment. Well the easy answer is "it depends", but what does it really depend on... Identify all of the phones: To find all of the phones on your network you may manually go through your Call-Manager or other Voice Server and export a list or utilize Cisco NAC Profiler to find all the phones. Please note that you must keep an updated list of all IP Phones in the CAM Device Filter Table in order for NAC to exclude the phones. Determine your NAC deployment type: When deploying an In-Band (IB) NAC Deployment, handling phones is very simplistic. One deployment option is when all of the phones are on a Voice VLAN they should bypass NAC. Meaning if the voice VLAN is NOT be bridged or routed through the CAS, the phones will never go through NAC. Another possibility, is the phones are on the same VLAN as users.(Please note it is a best practice to separate your voice devices from data devic...

I want to apologize for the lack of posts over the past couple of months. I have been out performing NAC Deployments non-stop. I thought I would kick things off by offering some updates on the latest software release. Look for more custom check and best practice posts soon. Also, if anyone has any requests on something they would like to see posted about let me know! Cisco Clean Access Agent 4.1.3.2 Some updates to the original 4.1.3.0 Agent has been made, refer to the release notes for all enhancements, bug fixes, etc. Cisco NAC Profiler 2.1.8-37 On April 7th, Cisco released an upgrade to NAC Profiler. Release Notes | Documentation Cisco NAC Guest Server 1.1.0 Cisco released an upgrade to the Guest Server. Check out the documentation for all enhancements/fixes Release Notes | Documentation

If everyone out there has not heard yet, there is a spring 2008 chalktalk series going on currently. The chalk talks are very technical and can give everyone great insight into the topics discussed. March 13th - Cisco NAC Deployment Methodologies March 20th - Troubleshooting Cisco NAC Appliance March 27th - NAC Profiler Best Practices All can be seen at 10am PDT at http://premium.meetingplace.net with meeting ID 434343 Also, Robb Boyd and the TechWise TV team posted a podcast on Troubleshooting Cisco NAC Appliance. It features "rockstar" Prem Ananthakrishnan, one of the great TMEs from the NAC BU. NAC Troubleshooting Podcast

There is a new TechWiseTV episode about to be taped, focusing on Cisco NAC Appliance and the producers are looking for feedback as to what the episode should focus on. The main presenter will be Alok Agrawal, one of the Technical Marketing Engineers from the Cisco NAC Business Unit. If you have never seen TechWiseTV, it is a highly technical show focusing on getting answers to the tough questions. I can promise that if enough of you want a topic discussed that Alok will definately be put on the spot to give you an answer. So please visit their website and start posting about what you are interested in hearing explained: http://www.mytechwisetv.com/page/30+Network+Admission+Control The following is a draft of the topics discussed: Proposed Segmentation: Segment 1: NAC Foundational Concepts - What is it, why do we need it, why now? Where does 802.1x fit, what problems can be solved here, etc. Posture Assesment - more than just AV and Spyware Client vs. Clientless, Inband vs. Out of Band...