1. Network Admission Control Configuration Guide Cisco IOS Release 15MT. Network Admission Control; NAC-Auth Fail Open; Network Admission Control Agentless Host Support; NAT. IP Addressing: NAT Configuration Guide, Cisco IOS Release 15M&T. Configuring NAT for IP Address Conservation; Using Application-Level Gateways with NAT.
2. Instead of downloading and installing an Agent application, once the user opens a browser window, logs in to the NAC Appliance web login page, and chooses to launch the temporal Cisco NAC Web Agent, an ActiveX control or Java applet initiates a self-extracting Agent installer on the client machine to install Agent files in a client’s.
3. Deployment Models. Cisco NAC Framework is a flexible solution providing protection to connected endpoints regardless of network connectivity. As shown in Figure 6-5, it operates across all access methods including campus switching, wired and wireless, WAN and LAN links, IP Security (IPSec) connections, and remote access links.
4. Oct 22, 2008 This document describes how to configure Mac OS X Clean Access Agent posture assessment via the Network Admission Control (NAC) Manager web console for release 4.5. Mac posture assessment in this release is limited to AV/AS support only. Refer to the Cisco NAC Appliance (Clean Access) Release Notes for the list of AV/AS that are supported on.

1. Cisco Network Admission Control Agent Software For Mac Osx
2. Cisco Network Admission Control Agent Software For Mac 2017

Network Magic was a program delivered by Cisco Systems. It was a popular tool for network computer management and monitoring, liked especially for its added security features, which included robust intrusion prevention and parent monitoring capacities. But when Cisco came out with its Smart Wi-Fi routers, the Network Magic program was discontinued—to the frustration of many loyal customers. There was much to love about Network Magic, which made replacing it with a viable alternative particularly difficult.

It’s worth noting, although Cisco discontinued Network Magic, it’s still usable in theory. The problem is because Cisco no longer provides updates, the program is now out of date. As a result, it’s often faulty. Moreover, there is no help desk supporting it. Continuing to use such an outdated program is not advisable, especially as it will only continue to decline as time passes. So for all practical purposes, Network Magic is a thing of the past.

Fortunately, there are Cisco Network Magic alternatives worth considering. Many programs like Network Magic exist, but not all are created equal. To give you an idea of what competitors are up against, I’ll start with a quick rundown of Network Magic’s best features.

Why Do I Need Network Magic?

Cisco’s Network Magic was a versatile, feature-rich tool with a wide range of utilities, and it afforded users surprising levels of convenience. It was compatible with both Mac OS and Windows. It came in a free version, known as Network Magic Essentials, and a small business edition called Network Magic Pro.

The NAD informs the posture agent of the healthy status, but no message is sent to the user this time. The user can now resume normal network activity. Network Admission for NAC Agentless Hosts. The previous example described the admission process for a NAC-enabled endpoint running a posture agent, such as Cisco Trust Agent.

If you’re going to be looking for software like Network Magic Pro, you’ll need to know what made it so popular. To keep this brief, I’ll outline what I consider to be the essential features of the Network Magic package.

• Parent Monitoring: Let’s start with parent monitoring. The parent monitoring tool included with Network Magic could be utilized to prevent children from accessing adult content and sites. It was also able to show you how often a specific site had been visited and how long the internet was being used for. The ability to block sites without impacting the computer’s capacity to share data via the network connection was certainly impressive, but it was just one of many fantastic functionalities.
• Remote Management: There was also Network Magic’s remote management utilities, which meant you could manage files and data on a device without needing to be on the device. The console gave you remote visibility of computers, letting you tweak their settings and monitor/manage them from afar. It also showed you when there had been any attempt to access the network without the correct level of authorization or permissions, which was a valued security feature.
• Network Mapping: Network Magic included a network map, which provided you with a visual overview of your entire network and the devices connected to it. This was a great utility because it gave you an idea of what was happening in your network on an at-a-glance basis. Identifying problems was faster and easier, because the map would draw attention to any underperforming devices. It would also display the device name and the specific issue—for example, failure to connect to the internet. The network map was generated automatically, so you didn’t need to waste any time adding devices manually.
• Troubleshooting: The troubleshooting utilities accompanying the Network Magic solution were impressive. You could analyze network connections, so you had the information to take action when necessary. This helped to keep the network stable. For example, if a connection were to fail, Network Magic’s troubleshooting utilities would help you reestablish the connection.
  There was also a repair wizard functionality, which led you through the troubleshooting process in a simple, step-by-step way. So if you didn’t know where to start troubleshooting, you could depend on the repair wizard to give you actionable advice, with clear instructions. These troubleshooting tools also let you test the internet connection to ensure appropriate connectivity.
• Reporting: Network Magic came with useful reporting utilities in both its versions. It could report on the IP address of each device, in addition to the software and hardware versions of devices. It could also give you visibility of bandwidth usage history for each computer.

Network Magic Pro offered a few more features, including enhanced Wi-Fi security, status alerts, and the ability to control internet access. It could also give you screenshots of device activity.

Alternatives to Cisco Network Magic

Cisco Network Admission Control Agent Software For Mac Osx

As Cisco Network Magic is now discontinued, out of date, and impractical, you’ll have to find a viable replacement. If you were a fan of Network Magic and value the extra features included with the Pro version, this article aims to help you find the best alternative.

Network Magic Pro let you connect devices in a matter of minutes. It allowed you to share files, printers, and internet connections. It protected your network with advanced WPA security capacities, while offering status alerts and the ability to proactively troubleshoot and repair your network. It’s hard to imagine a suitable alternative, but there are some powerful tools on the market in 2020. To make choosing between them easier, I’ve compiled this list of my favorites.

SolarWinds^® Network Performance Monitor and SolarWinds Network Configuration Manager come out on top. These products attest to SolarWinds reputation for producing intuitive, intelligent, feature-rich products. When combined, these two tools form a comprehensive and powerful network monitoring and management solution. Not only are they an effective Cisco Network Magic Pro alternative, but they also bring additional functionalities to the table even the original Network Magic program would struggle to compete with.

Check out my product list below if you want to know how I reached this conclusion, and to see how other products have fared in my estimation.

The Cisco network monitoring aspect of SolarWinds Network Performance Monitor (NPM) is the ideal Cisco Network Magic alternative. The automatic discovery utility is an especially attractive feature, allowing you to identify all Cisco network devices without any manual intervention. You don’t need CLI commands. Device discovery is rapid and regular, in addition to being supportive of multi-vendor devices.

SolarWinds NPM offers a versatile and feature-rich Cisco network monitoring solution. NPM is a multi-vendor monitoring tool covering a range of utilities, including:

• Cisco ACI environment monitoring
• Cloud server monitoring
• Deep packet inspection and analysis
• Huawei monitoring and reporting
• Huawei NetStream analysis
• LAN monitoring
• Link analysis
• Network analysis
• Network availability monitoring
• Network browsing
• Network device discovery
• Network device monitoring
• Network device scanning
• Network diagnostics
• Network fault management
• Network infrastructure monitoring
• Network latency testing
• Network mapping
• Traffic router monitoring
• WAN optimization monitoring

This list is by no means exhaustive, which demonstrates how wide-ranging NPM’s functionalities are (you can see a more complete list of NPM features here). Yet, unlike many tools, it does not compromise on quality in the name of quantity. All the tools within NPM are well designed, dynamic, and easy to use. Implementing NPM requires little to no prior knowledge. You don’t have to be a savvy techie and you won’t have to undertake any training to use it, which is one of the many reasons I like NPM so much.

Tracking the performance and health of SNMP-enabled devices is also a simple process, made even simpler by the console itself. The console is divided up into sections and makes use of icons to keep the interface from feeling cluttered. In my view, this is the mark of a cleverly designed program, because it takes into account the user experience and how a cluttered console can interfere with data interpretation.

Another thing I like about NPM is the Cisco network device mapping utility. The tool generates a network topology map, which is clear and easy to read, and you can create your own customized maps, to display the key metrics you want to prioritize—e.g., link utilization or connectivity. Being able to visualize network performance in this way is useful.

Visualization overall is something NPM does well. It polls MIBs on devices and obtains performance metrics, which it displays in dynamic charts, graphs, and customizable dashboards. Data is represented in a graphical and colorful way, making engaging with the program surprisingly enjoyable.

SolarWinds NPM isn’t just a replacement for Network Magic. It goes above and beyond, contributing far more to the network monitoring process than Cisco’s Network Magic did. If you want to give NPM a try, a fully functional 30-day free trial is available.

Note: NPM is also designed to be combined with SolarWinds Network Configuration Manager (reviewed below) to provide even more in-depth network monitoring functionalities.

Network Configuration Manager (NCM) is another SolarWinds product offering an excellent Cisco Network Magic Pro alternative. Like NPM, its scope goes well beyond the utilities provided by Network Magic.

Of NCM’s many features, network automation is among my favorites. By minimizing the time spent actioning repetitive tasks, this assists you in managing sudden changes across multi-vendor, complex networks. It’s surprising how many processes this tool automates—including change tracking and change management, compliance auditing, and configuration backups.

NCM also boasts Network Insight for Cisco ASA. This enables you to discover security contexts as well as restore and backup configuration files. You’re also able to audit access control lists, visualize them, and manage Cisco ASA firmware upgrades. What’s more, the monitoring and management of your ASA infrastructure is automated. Details and metrics can be viewed via the console, which displays instances of high availability, connections and connection rates, and RAM and CPU.

I’m also a fan of NCM’s reporting utilities. With 53 reports available, keeping stakeholders informed couldn’t be easier. You can create reports on configuration changes, network inventory, compliance with policy, planning requirements, and security.

If you want a truly comprehensive solution rivaling Network Magic, then I recommend combining SolarWinds NPM and NCM. Used in tandem, these highly integrable programs bring together multi-vendor network monitoring, advanced alerting, and NetPath critical path visualization with network automation, network compliance and management, and configuration backup. You’ll be able to certify network service availability, enhance visibility of your firewall infrastructure, and reduce the need for manual troubleshooting.

With these tools, you’ll be able to stay on top of Cisco ACI monitoring of data and control plane components. You’ll have access to Network Insight for Cisco Nexus and ASA, Cisco switch stack monitoring and Cisco Meraki monitoring capacities, Wi-Fi heatmaps, and much more.

As with NPM, SolarWinds offers a 30-day free trial of NCM, available here.

Paessler PRTG Network Monitor is another popular Network Magic alternative. Like the SolarWinds products, PRTG Network Monitor covers all the essential components of Cisco’s Network Magic. So, instead of reiterating Network Magic utilities here, I’ll highlight some of the other things PRTG can do for you.

PRTG is an all-in-one solution for tracking your network. With it, you can track network links, network devices, servers, and all associated activities, as well as the performance of applications, websites, and visualizations. PRTG can even be utilized to cover remote sites and cloud-based services. It’s a Windows-compatible program.

I like PRTG Network Monitor for several reasons. For a start, it’s a flexible tool to be installed either as a cloud service or on premises. This is limited if you choose the cloud version, you’ll still have to install a collector on-premises.

PRTG’s flexibility goes beyond installation. One of the best things about this tool is it’s extendable. Because this is a sensor-based application, you can expand on its functionalities by adding sensors. There are hundreds of sensors available, capable of covering almost any aspect of network monitoring, from DNS name resolution to Microsoft Exchange email delivery.

You can get PRTG Network Monitor up and running in a couple of minutes. This is thanks to the network auto-discovery feature, which will identify and map out all your infrastructures. This sets a baseline for your equipment inventory. PRTG also establishes a software log and includes a useful network mapping utility, which gives you an at-a-glance overview of your network in a straightforward layout.

PRTG monitoring is continuous, allowing you to stay on top of any changes in your network and any unusual network activity, and to safeguard device health. This constant monitoring informs the alerts system, which notifies you if anything unusual occurs. It keeps you in the know as to status issues and critical conditions, so you can take action before performance is affected. Furthermore, the way you view network activity can be customized by applying filters. These could include port number, application, or MAC address.

With PRTG, you are afforded in-depth insights into the performance of your network thanks to the use of network traffic messaging systems. These include J-Flow, NetFlow, sFlow, and IPFIX, all of which are used by switches and routers to report on network activity and status. The PRTG device monitoring component utilizes SNMP.

PRTG bases its pricing on its sensors, which have the primary benefit of allowing you to extend the program’s functionality. On the downside, the sensor-based pricing model means you may end up paying for more than you use. However, Paessler does allow you to have up to 100 sensors free of charge.

Like the SolarWinds products, PRTG is more than a Cisco Network Magic alternative—it ;s a comprehensive tool for network monitoring, offering similar functionalities to Network Magic, but with far greater scope. A 30-day free trial of the paid version is available.

Spiceworks IP Scanner is a free Cisco Network Magic alternative worth considering. This is a cloud-based program, though you do need to install a lightweight program onto your device to use it.

Spiceworks collects network data and uploads it directly to the cloud. If you’re concerned about security, rest assured all communications between the Spiceworks server and your device agent are encrypted, and a unique access key is required to access your network information. This keeps unauthorized individuals from being able to view sensitive data. In terms of the on-premises installation, it’s minimal, and only runs when required to.

In terms of how this tool compares to Network Magic, it offers the same level of device inventory utilities and network discovery functionalities but is more user-friendly. Spiceworks IP Scanner is available for Mac OS, Windows, Ubuntu, and Debian.

I like that the IP Scanner dashboard is accessible via your everyday web browser. This makes accessing it easy; it also means you don’t have to install tons of resource-consuming software. The problem with this approach is the program is only accessible when you have an internet connection. If you worry about the stability of your connection, this is likely to be a problem for you.

Spiceworks IP Scanner has clearly been well designed, and care has been taken in devising features to make scanning faster and simpler. The dashboard is easy to navigate, allowing you to filter your list of devices according to several components. Status reports can be exported to a CSV file, converted into a spreadsheet, or both. Device tracking is automatic and generates an inventory, with all the following details:

• IP address
• Hostname
• MAC address
• Operating system
• Description
• Manufacturer
• Open ports

Overall, Spiceworks IP Scanner is a suitable alternative to Cisco Network Magic. However, being free, this tool isn’t as rich in features as others on this list.

HomeNet Manager, by SingleClick Systems, is a program for Windows, though it’s capable of discovering devices with other operating systems when they’re connected to your network. I like this product because it’s simple. It doesn’t try too hard or throw super-complicated corporate-level utilities at you. This can be either good or bad, depending on your requirements. If you want a sophisticated tool, look elsewhere; but if you want something basic and you value usability, then HomeNet Manager might be the right Network Magic alternative for you. Just bear in mind, this product has been designed for home users, and as such may not be suitable for business use.

HomeNet Manager includes an automated network discovery feature, which will identify all your hardware and create a visual map of it. To me, the most notable feature of this tool is it can identify other Wi-Fi-enabled devices and connect to them without going through the router. Instead, HomeNet uses an ad hoc network. By installing this program, you can access info on any network you’re connected to, even public Wi-Fi hotspots.

The downsides of this tool is it can only be used with Windows. In addition, it could be improved by SingleClick Systems offering greater support.

HomeNet Manager can’t be downloaded via SingleClick Systems’ website. You can download it on CNET and try it free for 30 days. Once the trial has finished, you’ll have to pay to continue using the program.

My Favorite Network Magic Alternatives

Choosing between the various tools on the market isn’t easy. There are free, paid, and open source programs, all claiming to be the best of the best. Before giving you my final say on the subject of the best Network Magic alternatives, I’ll briefly mention open source programs.

When you’re searching for a Network Magic alternative, open source programs are bound to come up. Open source alternatives, while advantageous in many ways, aren’t especially well suited to business use, which is worth bearing in mind; nor are they as dependable as the paid solutions on this list.

My highest recommendations go to SolarWinds NPM and NCM, two user-friendly, dynamic, intelligent, and feature-rich pieces of software. If I had to choose between them, I would personally go for NPM, but I recommend bundling them for the best results. Together, these tools not only cover all the functionalities of Cisco Network Magic, but also bring a whole host of other valuable utilities to the table.

This chapter covers the following topics:

• Introduction to Network Admission Control
• Review of NAC Phase I and Phase II architecture
• Overview of the components that make up the NAC Framework solution, including:
  • - Cisco Trust Agent
  • - Cisco Security Agent
  • - Network-access devices
  • - Cisco Secure Access Control Server
  • - Event monitoring, correlation, and reporting

One of the biggest challenges corporations face today is securing the internal network. When the words network security are mentioned, most people immediately associate this phrase with protecting their network from external threats. Few people think of the internal threats that already exist. Unpatched end-host systems, out-of-date antivirus signatures, and disabled or nonexistent personal firewalls all weaken the internal security of corporate networks and make them vulnerable to data theft and attacks. Preventing or limiting these hosts' access to the corporate network has been difficult to do until now.

Cisco Systems has launched the Self-Defending Network Initiative (SDNI) to dramatically improve the network's capability to identify, prevent, and adapt to threats. A key part of this initiative is Network Admission Control (NAC). NAC is a multipart solution that validates the security posture of the endpoint before admitting it on the network. If admitted, NAC can also be used to define what resources the endpoint has access to, based on the endpoint's overall security posture.

This chapter is meant to provide you with an overall review of the NAC Framework solution. We start by covering what NAC is and why companies would want to deploy it. Then we cover an architectural overview of the initial NAC solution (NAC Phase I), followed by an architectural overview of the current NAC solution (NAC Phase II). In the remainder of the chapter, we provide an overview of the individual components that make up NAC. Each component has a dedicated chapter in this book where we cover the installation, configuration, and steps to troubleshoot that component in the NAC solution. After reading this chapter, you should be familiar with the concepts and components that make up the NAC Framework and should be ready to start installing and configuring NAC in your network.

If you are unfamiliar with NAC or are interested in learning more about the architecture of the NAC solution, we invite you to read Cisco Network Admission Control, Volume I: NAC Architecture and Design (ISBN 1587052415), published by Cisco Press.

Network Admission Control

Reports of data and identity theft have become hot topics in the news recently. Unfortunately, they have also become fairly common, often resulting in millions of dollars' worth of damage to the companies affected. Traditionally, network security professionals have focused much of their time securing the front door to their networked companies—their Internet presence. Stateful firewalls often sit at the gateways, and, in most cases, these are supplemented with inline intrusion-prevention devices (IPS), antivirus scanners, and denial-of-service (DoS) mitigation devices. Behind this virtual fortress of protection sit hardened servers, which serve up the corporate web presence. Many companies are proud of their investment in this type of security and advertise this fact. Now, don't get me wrong—this type of security is important. However, sometimes in the zeal to make the web presence secure, we forget that a huge threat exists from within.

It is becoming mandatory these days for employees to have access to the Internet; often it is a critical component of their jobs. However, have you thought about devices that your employees are using to access the Internet? How secure are they? If they are corporate assets, they should have the corporate antivirus software installed and possibly a personal firewall. But how do you know the employee has not disabled one or more of these and thereby reduced the security of not only the device, but also your internal network, and opened it up to threats?

While you are pondering that thought, let me give you another. How many noncorporate assets connect to your network? How many employees bring in their personal laptop, their personal digital assistant (PDA), or even their cell phone and connect it to the corporate network? What about partners and outside vendors? How much control do you have over these devices? Imagine what could happen if a rootkit or some other Trojan back door was installed on one of these devices and now has access to your internal network. How many confidential documents or corporate secrets could be stolen by attackers within?

It is often easier to consider the mistakes or ignorance of others, but how many times have you been guilty of letting the security of your own PC lapse? How many times have you been notified of a new critical security patch for your laptop or desktop and clicked the Not Now button, choosing instead to install it later? I am sure all of us are guilty of this; I know I am.

Installing security patches, especially to the operating system, usually results in the mandatory reboot. This usually comes at the worst time of the day, when shutting down your applications and rebooting is not an option. So we make a mental note to install the patches when we leave for the day, but how many times do we actually follow through? More often than not, weeks or months could go by before we find the time to install the patches. During this time, the PC remains susceptible to the targeted attack.

Although I have highlighted only a few of the common threats to the internal security of your corporate network, I am sure you can think of many more. Home users connecting via a VPN tunnel, remote sales forces connecting from the local hotspot or hotel, partners with direct site-to-site tunnels to your company—the list goes on. These are the types of threats NAC was designed to protect you against and eliminate.

NAC is a Cisco-led, multivendor initiative focused on eliminating threats to the corporate network caused by insecure endpoints attaching to the network. In its simplest form, NAC defines a set of policies that are used to evaluate the security posture of an endpoint that wants to join the network. The endpoint can be a PC, a PDA, a server, an IP phone, a printer, and so on. Based on the security posture of the endpoint, it can be given unrestricted access to the network—if it meets all the security requirements. Devices that fail to fully satisfy the security requirements can be quarantined where autoremediation ensues. (Remediation servers can automatically push out patches and updates to software running on the endpoints to improve their security posture.) Alternatively, devices can be denied access to the network altogether, or they can be placed in their own VLAN and given limited access to the network. All of these actions are fully configurable, along with the security policy to be enforced.

NAC: Phase I

Cisco rolled out NAC in a series of phases. Phase I was launched in the summer of 2004. It includes using Cisco routers as the enforcement point, running Cisco IOS Release 12.3(8)T or later. When NAC is deployed on Cisco IOS routers, it is called NAC-L3-IP because the router operates at Layer 3 (the IP layer) and contains noncompliant endpoints using Layer 3 Access Control Lists (ACLs). As endpoints attempt to access devices through the router, they are queried to determine their security posture. Based on the endpoint's security posture, a security policy for the endpoint is pushed down to the router that permits or restricts access. Figure 1-1 shows a NAC-L3-IP architecture overview.

Figure 1-1 NAC-L3-IP Architecture Overview

Follow along in Figure 1-1 as we walk through each step of this process:

1. The endpoint sends a packet, which passes through the router, on to its destination. The packet matches the Intercept ACL applied to the router's interface, which triggers the NAC-L3-IP posture-validation process.
2. The router initiates an EAP over UDP (EAPoUDP) tunnel to the Cisco Trust Agent (CTA) on the endpoint. This is the first part in setting up a secure tunnel between the endpoint and the Cisco Secure Access Control Server (ACS).
3. Next, the router initiates a RADIUS tunnel to the Cisco Secure ACS server. This is the second part in establishing a secure tunnel between the endpoint and Cisco Secure ACS.
4. With the EAPoUDP and RADIUS tunnels established, the Cisco Secure ACS server establishes a Protected Extensible Authentication Protocol (PEAP) tunnel with the endpoint and queries it for posture credentials. The posture credentials are sent to Cisco Secure ACS using EAP type-length-values (EAP-TLVs). The EAP-TLVs allow for any number of posture credentials to be returned from the end device.
5. (Optional) Cisco Secure ACS proxies some of the posture credentials to additional validation servers (in this case, an antivirus server) using the Host Credentials Authorization Protocol (HCAP).
6. Cisco Secure ACS analyzes the end host's security posture by passing the posture credentials through rules, defined by the administrator in Cisco Secure ACS, or by sending them to external posture-validation servers. The host is then assigned an overall security posture, based on those results. The overall security posture is then forwarded to the router, along with the associated access list, which restricts the host's access to the network, based on its security posture.
7. (Optional) Cisco Secure ACS can also send a message to the endpoint, which, in turn, is displayed to the user to provide notification about the security posture of the host. Cisco Secure ACS can also redirect the user's browser to a remediation server, where patches and updates can be applied.
8. If the host is deemed 'healthy' (its security posture meets the requirements of the company), it is permitted to access the network unrestricted.

The protocols used in Figure 1-1 are discussed in more detail in later chapters. For now, it is important to know only that the posture credentials and security policy are carried over authenticated and encrypted tunnels for added security. Figure 1-2 illustrates the relationship among these protocols in a graphical way. The PEAP-encrypted tunnel is carried over both the RADIUS and EAPoUDP tunnels. It contains the EAP-TLVs used to determine the host's posture.

Figure 1-2 Graphical Representation of Protocols Used in Phase I NAC

NAC: Phase II

Cisco launched NAC Phase II in the summer of 2005. Phase II expands on Phase I by placing NAC capabilities into several more product lines, including the Catalyst line of switches, the VPN 3000 series concentrators, the ASA 5500 series and PIX 500 series security appliances, the Aironet wireless access points, and the Wireless LAN Service Module. With these new additions, the enforcement point has moved to the network edge, providing enforcement and containment at a port (or host) level instead of at the gateway. These additions also created some new terminology:

• NAC-L2-IP—The term NAC-L2-IP is used when NAC is applied to a Catalyst switch, on a per-port basis. You can think of NAC-L2-IP as being identical to NAC-L3-IP, but the enforcement policy is an IP-based ACL applied to a switch port instead of a routed port. Likewise, the protocol flow as defined in Figure 1-1 is the same for NAC-L2-IP.

  One other difference between NAC-L2-IP and NAC-L3-IP is that, in NAC-L2-IP, the posture assessment is triggered when the switch port receives a Dynamic Host Configuration Protocol (DHCP) packet or an Address Resolution Protocol (ARP) packet from the endpoint attempting to connect to the network. Then the switch establishes the EAPoUDP tunnel to the endpoint to start the posture-validation process.

• NAC-L2-802.1X—The term NAC-L2-802.1X is used when NAC is applied to a switch port along with 802.1X authentication. 802.1X provides for both user- and machine-based authentication of the endpoint before the switchport forwards any traffic to the network. NAC-L2-802.1X adds security posturing to 802.1X by way of the Extensible Authentication Protocol–Flexible Authentication via Secure Tunneling (EAP-FAST) protocol. Thus, the posture credentials are carried through EAP-FAST over a Transport Layer Security (TLS) tunnel from the endpoint directly to Cisco Secure ACS. Consequently, an 802.1X supplicant that supports EAP-FAST is needed for NAC-L2-802.1X.

  When NAC-L2-802.1X is enabled and a PC is connected to a switch port, 802.1X authentication and posture validation occur within the same EAP transaction. The posture credentials are included within the EAP-FAST messages that are transmitted on top of the 802.1X protocol. However, unlike NAC-L3-IP and NAC-L2-IP, posture enforcement is done not through ACLs but instead solely through VLAN assignment.

Figure 1-3 illustrates NAC-L2-802.1X on a switch that uses 802.1X authentication as the Layer 2 protocol.

Follow along in Figure 1-3 as we walk through the process of what happens when an endpoint connects to a switch with NAC-L2-802.1X enabled on the port:

1. The end device is attached to a switch port.
2. As the link comes up, the client's 802.1X supplicant initiates an authentication request with the switch via 802.1X.
3. The user's (or machine's) credentials are sent from the switch to the Cisco Secure ACS server via RADIUS.
4. The Cisco Secure ACS server authenticates the user (or machine).
5. CTA and Cisco Secure ACS now establish an EAP-FAST tunnel over the existing 802.1x and RADIUS sessions.
6. The Cisco Secure ACS server queries CTA for posture credentials using the EAP tunnel.
7. (Optional) Cisco Secure ACS optionally proxies some of the posture credentials to additional validation servers (in this case, an antivirus server) using HCAP. These validation servers can notify the agents on the endpoint and trigger their own updates.
8. Cisco Secure ACS applies the security policy to the retrieved posture credentials, and the host is assigned an overall posture. This security posture is forwarded to the switch along with the associated VLAN to be applied to the port the host is connected to.
9. (Optional) Based on the posture credentials, Cisco Secure ACS can send a message to the end host to be displayed to the user or can redirect the browser to a remediation server. The remediation server can automatically push out patches and updates to the endpoint to bring it in compliance with the corporate security policy.
10. The host is now permitted (or denied) access to the network, based on its posture and the VLAN it is assigned to.

Periodic Revalidation

Periodic revalidations are built into the NAC-L3-IP and NAC-L2-IP solution. The network-access device (NAD) initiates the process by periodically polling validated endpoints to determine whether a change has been made in their posture. CTA alerts the NAD of any changes on the end host, and the NAD then issues a full revalidation and posture assessment.

This security measure prevents users from validating their host and then lowering their security posture after they have been granted access to the network.

Additionally, a separate revalidation timer requires all active hosts to be fully revalidated every 30 minutes, by default. This enables the network administrator to change the security policy on the fly. All already-validated end hosts must meet this new policy when their revalidation timer expires. The following example further illustrates this point:

Bob, the network administrator of example.com, receives a new alert about a critical security vulnerability in Microsoft Windows. Realizing the security impact that this vulnerability might have on his network, Bob immediately modifies his NAC security policy to require the hotfix that addresses this vulnerability to be applied on all end hosts on his network. Because it is during the day, most users validated their machines on the network when they arrived in the morning. Without periodic revalidation, Bob would have to wait until each user disconnects and reconnects to the network before the endpoint is revalidated. However, the revalidation timer solves this by requiring all active, validated hosts to be fully revalidated every 30 minutes (by default).

NAC Agentless Hosts

A NAC agentless host (NAH) (or a clientless endpoint) is a device that does not have CTA installed. Therefore, it cannot respond to the EAPoUDP or EAP-FAST request from the NAD. A printer, a webcam, an IP phone, and a guest PC are all examples of NAHs.

Individual policies can be defined on the NAD for NAHs. The policy can be designed to exclude a specific MAC or IP address or a range of addresses. Alternatively, a global policy can be defined on Cisco Secure ACS for NAHs. After the EAPoUDP or EAP-FAST session times out, the NAD can notify Cisco Secure ACS of the NAH, and Cisco Secure ACS can apply the appropriate authorization rights. We look at NAHs in more detail in Chapters 4, 'Configuring Layer 2 NAC on Network-Access Devices,' through 8, 'Cisco Secure Access Control Server.'

Another option for NAHs (which is part of NAC Phase II) is to use an audit server to scan the host for the services running on it and potential vulnerabilities. Cisco Secure ACS instructs the audit server on which hosts to scan by using the Generic Authorization Message Exchange (GAME) protocol. When the scan is complete, the audit server returns the results to Cisco Secure ACS through the GAME protocol, and Cisco Secure ACS uses these results to apply a security posture and overall policy to the end host.

NAC Program Participants

Cisco Network Admission Control Agent Software For Mac 2017

Cisco Systems leads the NAC program, but is open to any vendor that wants to participate. To ensure interoperability, Cisco requires all vendors shipping NAC-enabled code to have it tested either by an independent third-party testing center or by Cisco Systems. At the time of publication, more than 75 vendors were enrolled in the NAC program. A current list of program participants is maintained by Cisco at http://www.cisco.com/web/partners/pr46/nac/partners.html.