Cisco NAC Appliance

506 Pages·2007·12.88 MB·English

Cisco NAC Appliance - Clean Access
Manager Installation and Administration
Guide
Release 4.1
December 2006
Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-12214-01
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems,
Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press,
Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing,
FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys,
MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet
Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0705R)
Nessus is the trademark of Tenable Network Security.
Cisco NAC Appliance - Clean Access Manager includes software developed by the Apache Software Foundation (http://www.apache.org/) Copyright © 1999-2000 The
Apache Software Foundation. All rights reserved. The APACHE SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR ITS CONTRIBUTORS OR CISCO OR ITS CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
USE OF THE APACHE SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
© 2007 Cisco Systems, Inc. All rights reserved.
C O N T E N T S
Audience i
Purpose i
Document Conventions ii
Product Documentation ii
Obtaining Documentation iii
Cisco.com iii
Product Documentation DVD iv
Ordering Documentation iv
Documentation Feedback iv
Cisco Product Security Overview iv
Reporting Security Problems in Cisco Products v
Product Alerts and Field Notices v
Obtaining Technical Assistance vi
Cisco Support Website vi
Submitting a Service Request vii
Definitions of Service Request Severity vii
Obtaining Additional Publications and Information vii
CHAPTER 1 Introduction 1-1
What Is Cisco NAC Appliance (Cisco Clean Access)? 1-1
Cisco NAC Appliance Components 1-2
Clean Access Manager (CAM) 1-4
Clean Access Server (CAS) 1-4
Clean Access Agent 1-5
Managing Users 1-5
Installation Requirements 1-7
Product Licensing and Service Contract Support 1-7
Upgrading the Software 1-7
Cisco NAC Appliance Hardware Platforms 1-7
Supported Server Hardware Platforms 1-8
Minimum System Requirements 1-8
Important Release Information 1-8
Overview of Web Admin Console Elements 1-8
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
OL-12214-01 i
Contents

Clean Access Server (CAS) Management Pages 1-9
Admin Console Summary 1-11
CHAPTER 2 Installing the Clean Access Manager 2-1
Overview 2-1
Set Up the Clean Access Manager NAC Appliance 2-2
Access the CAM Over a Serial Connection 2-4
Install the Clean Access Manager Software from CD-ROM 2-6
CD Installation Steps 2-6
Perform the Initial Configuration 2-7
Configuration Utility Script 2-8
Important Notes for SSL Certificates 2-10
Using the Command Line Interface (CLI) 2-11
Troubleshooting Network Card Driver Support Issues 2-12
CAM/CAS Connectivity Across Firewall 2-12
Access the CAM Web Console 2-12
CHAPTER 3 Device Management: Adding Clean Access Servers, Adding Filters 3-1
Working with Clean Access Servers 3-2
Add Clean Access Servers to the Managed Domain 3-2
Troubleshooting when Adding the Clean Access Server 3-4
Manage the Clean Access Server 3-4
Check Clean Access Server Status 3-5
Disconnect a Clean Access Server 3-5
Reboot the Clean Access Server 3-5
Remove the Clean Access Server from the Managed Domain 3-5
Global and Local Administration Settings 3-6
Global and Local Settings 3-7
Global Device and Subnet Filtering 3-7
Overview 3-7
Device Filters and User Count License Limits 3-8
Adding Multiple Entries 3-9
Corporate Asset Authentication and Posture Assessment by MAC Address 3-9
Device Filters for In-Band Deployment 3-10
Device Filters for Out-of-Band Deployment 3-10
Device Filters and IPSec/L2TP/PPTP Connections to CAS 3-11
Device Filters and Gaming Ports 3-11
Global vs. Local (CAS-Specific) Filters 3-11
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
ii OL-12214-01
Contents

Configure Device Filters 3-12
Add Global Device Filter 3-12
Display / Search Device Filter Policies 3-15
Order Device Filter Wildcard/Range Policies 3-16
Test Device Filter Policies 3-17
View Active L2 Device Filter Policies 3-17
Edit Device Filter Policies 3-18
Delete Device Filter Policies 3-18
Configure Subnet Filters 3-19
CHAPTER 4 Switch Management: Configuring Out-of-Band (OOB) Deployment 4-1
Overview 4-1
In-Band Versus Out-of-Band 4-2
Out-of-Band Requirements 4-2
SNMP Control 4-4
Deployment Modes 4-4
Basic Connection 4-4
Out-of-Band Virtual Gateway Deployment 4-6
Out-of-Band Real-IP/NAT Gateway Deployment 4-9
L3 Out-of-Band Deployment 4-12
Configuring Your Network for Out-of-Band 4-12
Configure Your Switches 4-12
Configuration Notes 4-12
Example Switch Configuration Steps 4-13
OOB Network Setup / Configuration Worksheet 4-17
Configure OOB Switch Management in the CAM 4-18
Add Out-of-Band Clean Access Servers and Configure Environment 4-19
Configure Group Profiles 4-21
Add Group Profile 4-22
Edit Group Profile 4-22
Configure Switch Profiles 4-23
Add Switch Profile 4-24
Configure Port Profiles 4-26
Add Port Profile 4-27
Configure SNMP Receiver 4-32
SNMP Trap 4-32
Advanced Settings 4-33
Add Managed Switch 4-36
Add New Switch 4-36
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
OL-12214-01 iii
Contents

Search New Switches 4-38
Discovered Clients 4-39
Manage Switch Ports 4-40
Ports Tab 4-40
Config Tab 4-47
Out-of-Band User List Summary 4-50
OOB Troubleshooting 4-51
OOB Switch Trunk Ports After Upgrade 4-51
Unable to Control <Switch IP> 4-51
OOB Error: connected device <client_MAC> not found 4-52
CHAPTER 5 Configuring User Login Page and Guest Access 5-1
User Login Page 5-2
Unauthenticated Role Traffic Policies 5-2
Proxy Settings 5-3
Add Default Login Page 5-3
Change Page Type (to Frame-Based or Small-Screen) 5-5
Enable Web Client for Login Page 5-6
DHCP Release/Renew with Clean Access Agent/ActiveX/Applet 5-6
Customize Login Page Content 5-9
Create Content for the Right Frame 5-11
Upload a Resource File 5-12
Customize Login Page Styles 5-13
Configure Other Login Properties 5-14
Redirect the Login Success Page 5-14
Specify Logout Page Information 5-15
Guest User Access 5-16
Enable Login Page “Guest Access” 5-16
Enable Guest Users with Any Credential 5-17
CHAPTER 6 User Management: Configuring User Roles and Local Users 6-1
Overview 6-1
Create User Roles 6-1
User Role Types 6-2
Unauthenticated Role 6-3
Normal Login Role 6-3
Clean Access Roles 6-4
Session Timeouts 6-5
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
iv OL-12214-01
Contents

Default Login Page 6-6
Traffic Policies for Roles 6-6
Add New Role 6-6
Role Properties 6-8
Modify Role 6-12
Edit a Role 6-12
Delete Role 6-13
Create Local User Accounts 6-14
Create a Local User 6-14
CHAPTER 7 User Management: Configuring Auth Servers 7-1
Overview 7-1
Adding an Authentication Provider 7-4
Kerberos 7-5
RADIUS 7-6
Windows NT 7-8
LDAP 7-9
Active Directory Single Sign-On (SS0) 7-10
Windows NetBIOS SSO 7-10
Implementing Windows NetBIOS SSO 7-10
Cisco VPN SSO 7-12
Allow All 7-13
Configuring Authentication Cache Timeout (Optional) 7-14
Authenticating Against Backend Active Directory 7-15
AD/LDAP Configuration Example 7-15
Map Users to Roles Using Attributes or VLAN IDs 7-17
Configure Mapping Rule 7-18
Editing Mapping Rules 7-23
Auth Test 7-25
RADIUS Accounting 7-27
Enable RADIUS Accounting 7-27
Restore Factory Default Settings 7-28
Add Data to Login, Logout or Shared Events 7-28
Add New Entry (Login Event, Logout Event, Shared Event) 7-29
CHAPTER 8 Configuring Active Directory Single Sign-On (AD SSO) 8-1
AD SSO Overview 8-1
Windows SSO Process (Kerberos Ticket Exchange) 8-2
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
OL-12214-01 v
Contents

CAS Communication with AD Server 8-3
AD SSO Configuration Step Summary 8-4
Configuration Prerequisites 8-4
Configuration Step Summary 8-5
Add Active Directory SSO Auth Server 8-6
Configure Traffic Policies for Unauthenticated Role 8-7
Configure AD SSO on the CAS 8-9
Configure the AD Server and Run KTPass Command 8-11
Create the CAS User 8-11
Install Support Tools 8-14
Run ktpass.exe Command 8-15
Example KTPass Command Execution 8-18
Enable Agent-Based Windows Single Sign-On with Active Directory (Kerberos) 8-19
Confirm AD SSO Service Is Started 8-20
Enable GPO Updates 8-21
Add LDAP Lookup Server for Active Directory SSO (Optional) 8-22
Troubleshooting 8-24
CHAPTER 9 User Management: Traffic Control, Bandwidth, Schedule 9-1
Overview 9-1
Global vs. Local Scope 9-3
View Global Traffic Control Policies 9-3
Add Global IP-Based Traffic Policies 9-4
Add IP-Based Policy 9-4
Edit IP-Based Policy 9-7
Add Global Host-Based Traffic Policies 9-8
Add Trusted DNS Server for a Role 9-8
Enable Default Allowed Hosts 9-9
Add Allowed Host 9-10
View IP Addresses Used by DNS Hosts 9-11
Proxy Servers and Host Policies 9-12
Control Bandwidth Usage 9-13
Configure User Session and Heartbeat Timeouts 9-15
Session Timer 9-15
Heartbeat Timer 9-15
In-Band (L2) Sessions 9-15
OOB (L2) and Multihop (L3) Sessions 9-16
Session Timer / Heartbeat Timer Interaction 9-16
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
vi OL-12214-01
Contents

Configure Session Timer (per User Role) 9-17
Configure Heartbeat Timer (User Inactivity Timeout) 9-17
Configure Policies for Agent Temporary and Quarantine Roles 9-19
Configure Clean Access Agent Temporary Role 9-19
Configure Session Timeout for the Temporary Role 9-19
Configure Traffic Control Policies for the Temporary Role 9-20
Configure Network Scanning Quarantine Role 9-21
Create Additional Quarantine Role 9-21
Configure Session Timeout for Quarantine Role 9-22
Configure Traffic Control Policies for the Quarantine Role 9-23
Example Traffic Policies 9-24
Allowing Authentication Server Traffic for Windows Domain Authentication 9-24
Allowing Traffic for Enterprise AV Updates with Local Servers 9-24
Allowing Gaming Ports 9-24
Microsoft Xbox 9-25
Other Game Ports 9-25
Adding Traffic Policies for Default Roles 9-27
Troubleshooting Host-Based Policies 9-29
CHAPTER 10 Clean Access Implementation Overview 10-1
Clean Access Overview 10-1
Clean Access Agent 10-5
Clean Access Updates 10-6
Network Scanner 10-7
Certified List 10-7
Role-Based Configuration 10-9
Clean Access Setup Steps 10-9
Retrieving Updates 10-11
Download Cisco Updates 10-14
General Setup Summary 10-17
Agent Login 10-17
Web Login 10-20
User Page Summary 10-22
Manage Certified Devices 10-26
Add Exempt Device 10-27
Clear Certified or Exempt Devices Manually 10-28
View Clean Access Reports for Certified Devices 10-28
View Switch Information for Out-of-Band Certified Devices 10-29
Configure Certified Device Timer 10-29
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
OL-12214-01 vii
Contents

Add Floating Devices 10-32
CHAPTER 11 Distributing the Clean Access Agent 11-1
Summary 11-1
Configuration Steps for Clean Access Agent 11-2
Add Default Login Page 11-3
Require Use of the Clean Access Agent 11-3
Configure Restricted Network Access for Agent Users 11-5
Configure Network Policy Page (Acceptable Use Policy) for Agent Users 11-6
Configure the Clean Access Agent Temporary Role 11-6
Enable Network Access (L3 or L2) 11-7
Enable L3 Deployment Support 11-8
Clean Access Agent Sends IP/MAC for All Available Adapters 11-8
VPN/L3 Access for Clean Access Agent 11-9
Enable L3 Support 11-9
Disabling L3 Capability 11-10
Enabling L2/L3 Strict Mode (Clean Access Agent Only) 11-11
Configuring Agent Distribution/Installation 11-12
Distribution Page 11-12
Installation Page 11-15
Clean Access Agent Stub Installer 11-17
SSL Requirements for Mac OS/CAS Communication 11-18
Configure Clean Access Agent Auto-Upgrade 11-19
Enable Agent Auto-Upgrade on the CAM 11-19
Disable Agent Upgrades to Users 11-19
Disable Mandatory Auto-Upgrade on the CAM 11-19
User Experience for Auto-Upgrade 11-20
Uninstalling the Agent 11-20
Agent Setup and Agent Patch (Upgrade) Files 11-20
Loading Agent Installation Files to the CAM 11-21
Auto-Upgrade Compatibility 11-21
Upgrading from 3.5.0 and Below Agents 11-23
Agent Upgrade Through File Distribution Requirement 11-23
Manually Uploading the Agent to the CAM 11-25
Downgrading the Agent 11-26
CHAPTER 12 Configuring Clean Access Agent Requirements 12-1
Summary 12-1
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
viii OL-12214-01