Cisco Systems. Implementing Cisco NAC Appliance. Volume 1. Student Guide

444 Pages·2016·16.37 MB·English

CANAC
Implementing Cisco
NAC Appliance
Volume 1
Version 2.1

Student Guide

Editorial, Production, and Web Services: 02.26.07

The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
DISCLAIMER WARRANTY: THIS CONTENT IS BEING PROVIDED “AS IS.” CISCO MAKES AND YOU RECEIVE NO WARRANTIES IN
CONNECTION WITH THE CONTENT PROVIDED HEREUNDER, EXPRESS, IMPLIED, STATUTORY OR IN ANY OTHER PROVISION OF
THIS CONTENT OR COMMUNICATION BETWEEN CISCO AND YOU. CISCO SPECIFICALLY DISCLAIMS ALL IMPLIED
WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR A PARTICULAR
PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE. This learning product may contain early release
content, and while Cisco believes it to be accurate, it falls subject to the disclaimer above.
The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
Students, this letter describes important
course evaluation access information!
Welcome to Cisco Systems Learning. Through the Cisco Learning Partner Program,
Cisco Systems is committed to bringing you the highest-quality training in the industry.
Cisco learning products are designed to advance your professional goals and give you
the expertise you need to build and maintain strategic networks.
Cisco relies on customer feedback to guide business decisions; therefore, your valuable
input will help shape future Cisco course curricula, products, and training offerings.
We would appreciate a few minutes of your time to complete a brief Cisco online
course evaluation of your instructor and the course materials in this student kit. On the
final day of class, your instructor will provide you with a URL directing you to a short
post-course evaluation. If there is no Internet access in the classroom, please complete
the evaluation within the next 48 hours or as soon as you can access the web.
On behalf of Cisco, thank you for choosing Cisco Learning Partners for your
Internet technology training.
Sincerely,
Cisco Systems Learning

The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
Table of Contents
Volume 1
Course Introduction 1
Overview 1
Learner Skills and Knowledge 1
Course Goal and Objectives 2
Course Flow 3
Additional References 4
Cisco Glossary of Terms 4
Cisco NAC Endpoint Security Solutions 1-1
Overview 1-1
Module Objectives 1-1
Introducing Cisco Self-Defending Networks 1-3
Overview 1-3
Objectives 1-3
Changing Landscape of Security 1-4
Cisco Host-Protection Strategy 1-7
The Cisco SDN Initiative 1-8
Cisco NAC Products 1-14
Summary 1-18
Introducing Cisco NAC Appliance 1-19
Overview 1-19
Objectives 1-19
Cisco NAC Appliance Solution 1-20
Cisco NAC Appliance Components 1-24
Cisco NAC Appliance Platforms 1-29
Cisco NAC Appliance Local and Remote Compliance Scenarios 1-30
Cisco NAC Appliance Configuration Overview 1-33
Cisco NAC Appliance User Interface 1-35
Summary 1-37
Introducing In-Band and Out-of-Band Deployment Options 1-39
Overview 1-39
Objectives 1-39
Cisco NAS Deployment Options 1-40
In-Band and Out-of-Band Deployment Options 1-44
Cisco NAC Appliance Out-of-Band Deployment 1-46
Cisco NAC Appliance In-Band Deployment 1-49
Cisco NAS Operating Modes 1-51
Summary 1-56
Module Summary 1-57
References 1-57
Module Self-Check 1-58
Module Self-Check Answer Key 1-62
Cisco NAC Appliance Common Elements Configuration 2-1
Overview 2-1
Module Objectives 2-1
The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
Configuring User Roles 2-3
Overview 2-3
Objectives 2-3
What Is a User Role? 2-4
Managing User Roles 2-8
Defining Traffic Policies for User Roles 2-13
Configuring Traffic Policies for User Roles 2-16
Creating Local User Accounts 2-23
Configuring User Session Timeouts 2-25
Configuring Guest Access 2-30
Summary 2-34
Configuring External Authentication 2-35
Overview 2-35
Objectives 2-35
Configuring External Authentication Providers 2-36
Mapping Users to User Roles 2-44
Testing User Authentication 2-48
Configuring RADIUS Accounting for Users 2-49
Summary 2-54
Configuring DHCP on the Cisco NAS 2-55
Overview 2-55
Objectives 2-55
Cisco NAS DHCP Modes 2-56
Enabling the DHCP Module 2-58
Configuring IP Ranges 2-60
Working with Subnets 2-71
Reserving IP Addresses 2-75
Configuring User-Specified DHCP Options 2-78
Summary 2-82
Module Summary 2-83
References 2-83
Module Self-Check 2-84
Module Self-Check Answer Key 2-86
Cisco NAC Appliance Implementation 3-1
Overview 3-1
Module Objectives 3-1
Implementing Cisco NAC Appliance In-Band Deployment 3-3
Overview 3-3
Objectives 3-3
In-Band Process Flow 3-4
In-Band Deployment Configurations 3-8
Configuring the Cisco NAS for In-Band Deployment 3-14
Adding the Cisco NAS to the Managed Domain 3-16
Configuring the Cisco NAS Interfaces 3-18
Adding Managed Subnets 3-20
Configuring Cisco NAS VLAN Settings 3-22
Summary 3-27
ii Implementing Cisco NAC Appliance (CANAC) v2.1 © 2007 Cisco Systems, Inc.
The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
Implementing the Microsoft Windows SSO Feature on the Cisco NAC Appliance 3-29
Overview 3-29
Objectives 3-29
Cisco NAC Appliance SSO for Microsoft Windows 3-30
Kerberos Ticket Exchange 3-32
Communicating Between Cisco NAS and a Microsoft Windows Active Directory Server 3-34
Configuring Active Directory SSO for the Cisco NAM, Cisco NAS, and Microsoft Windows Active
Directory Server 3-35
Summary 3-50
Implementing the Cisco VPN SSO Feature on the Cisco NAC Appliance 3-51
Overview 3-51
Objectives 3-51
Introducing Cisco NAC Appliance VPN SSO 3-52
Introducing VPN SSO Support 3-54
Configuring Cisco NAC Appliance for VPN Concentrator or ASA Integration 3-55
Summary 3-71
Implementing Cisco NAC Appliance Out-of-Band Deployment 3-73
Overview 3-73
Objectives 3-73
Out-of-Band Process Flow 3-74
Out-of-Band Deployment Considerations 3-78
Adding an Out-of-Band Cisco NAS to the Cisco NAM 3-83
Implementing Cisco NAS Out-of-Band Operating Modes 3-87
Summary 3-97
Managing Switches 3-99
Overview 3-99
Objectives 3-99
Implementing Switch Management 3-100
Configuring the Network for Out-of-Band Deployment 3-101
Configuring Group Profiles 3-106
Configuring Switch Profiles 3-110
Configuring Port Profiles 3-113
Configuring the SNMP Receiver 3-119
Adding Switches to the Managed Domain 3-123
Configuring Switch Ports to Use Port Profiles 3-129
Managing Switch Configuration Settings 3-134
Summary 3-138
Module Summary 3-139
References 3-140
Module Self-Check 3-141
Module Self-Check Answer Key 3-145
Cisco NAC Appliance Implementation Options 4-1
Overview 4-1
Module Objectives 4-1
Implementing Cisco NAC Appliance on a Network 4-3
Overview 4-3
Objectives 4-3
Implementing Cisco NAC Appliance 4-4
Introducing the General Setup Tab 4-11
Introducing User Pages 4-14
Managing Certified Devices 4-17
Summary 4-29
© 2007 Cisco Systems, Inc. Implementing Cisco NAC Appliance (CANAC) v2.1 iii
The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
Implementing Network Scanning 4-31
Overview 4-31
Objectives 4-31
Introducing Network Scanning 4-32
Configuring the Quarantine Role 4-34
Implementing Nessus Plug-Ins 4-40
Testing a Scanning Configuration 4-48
Customizing the User Agreement Page 4-49
Viewing Scan Reports 4-52
Summary 4-54
Configuring the Cisco NAM to Implement the Cisco NAA on User Devices 4-55
Overview 4-55
Objectives 4-55
Configuring the Cisco NAM to Implement the Cisco NAA 4-56
Retrieving Updates 4-57
Requiring the Use of the Cisco NAA 4-59
Configuring the Cisco NAA Temporary Role 4-62
Introducing Cisco NAA Checks, Rules, and Requirements 4-65
Creating a Check 4-74
Creating Rules 4-75
Creating Requirements 4-80
Mapping Requirements to Rules and Roles 4-85
Summary 4-88
Configuring Cisco NAM High Availability 4-89
Overview 4-89
Objectives 4-89
Introducing High Availability for Cisco NAMs 4-90
Establishing a Serial Connection Between Cisco NAMs 4-95
Configuring the Primary Cisco NAM 4-98
Configuring the Secondary Cisco NAM 4-102
Summary 4-105
Configuring Cisco NAS High Availability 4-107
Overview 4-107
Objectives 4-107
Introducing High Availability for Cisco NASs 4-108
Configuring the Primary Cisco NAS 4-112
Configuring the Secondary Cisco NAS 4-117
Testing the Cisco NAS High-Availability Configuration 4-123
Configuring DHCP Failover 4-124
Summary 4-130
Module Summary 4-131
References 4-131
Module Self-Check 4-132
Module Self-Check Answer Key 4-138

iv Implementing Cisco NAC Appliance (CANAC) v2.1 © 2007 Cisco Systems, Inc.
The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
CANAC
Course Introduction
Overview
The Cisco Self-Defending Network (SDN) strategy addresses the need for Network Admission
Control (NAC). The Cisco NAC Appliance is an easily deployed software NAC solution that
can automatically detect, isolate, and clean infected or vulnerable devices that attempt to access
your network. The Implementing Cisco NAC Appliance (CANAC) v2.1 course will provide
learners with the skills and knowledge to be able to implement the Cisco NAC Appliance
solution as a part of a Cisco SDN security strategy.
Learner Skills and Knowledge
This subtopic lists the skills and knowledge that learners must possess to benefit fully from the
course. The subtopic also includes recommended Cisco learning offerings that learners should
first complete to benefit fully from this course.
Learner Skills and Knowledge
(cid:131) Working knowledge of routing and switching or CCNA
(cid:131) Working knowledge of VLANs or BCMSN
(cid:131) Working knowledge of digital certificates or SNRS
(cid:131) Working knowledge of HSRP or BCSI
(cid:131) Fundamental knowledge of implementing network security or
SND or CCSP or Cisco Security CQS

©2007 Cisco Systems, Inc. All rights reserved. CANAC v2.1—3

The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.
Course Goal and Objectives
This topic describes the course goal and objectives.
Course Goal
“Upon completion of this course, you
will have the skills and knowledge to
implement a Cisco NAC Appliance solution
into a network equipped with
Cisco products.”
Implementing NAC Appliance

©2007 Cisco Systems, Inc. All rights reserved. CANAC v2.1—4
Upon completing this course, you will be able to meet these objectives:
(cid:132) Given network security requirements, select the appropriate NAC endpoint security
deployment scenario that will meet or exceed network security requirements
(cid:132) Configure the elements of a NAC Appliance solution
(cid:132) Configure the NAC Appliance in-band and out-of-band implementation options
(cid:132) Implement a highly available NAC Appliance solution to mitigate network threats and
facilitate network access for those users that meet corporate security requirements
(cid:132) Maintain a highly available NAC Appliance deployment in medium-sized and enterprise-
sized network environments

2 Implementing Cisco NAC Appliance (CANAC) v2.1 © 2007 Cisco Systems, Inc.
The PDF files and any printed representation for this material are the property of Cisco Systems, Inc.,
for the sole use by Cisco employees for personal study. The files or printed representations may not be
used in commercial training, and may not be distributed for purposes other than individual self-study.