Cisco Releases Idenity Services Engine (AKA ISE)

Introduction

After years of innovation around Network Access Control, Cisco has released its next generation NAC solution: Identity Services Engine. ISE is combines existing loosely coupled devices AAA, profiling, posture and guest management - in single, scalability appliance. As part of the Cisco TrustSec solution and Cisco’s SecureX architecture for Borderless Networks, the Cisco Identity Service Engine provides a centralized policy engine for business relevant policy definition and enforcement. This policy work horse enables centralized, coordinated policy creation and consistent policy enforcement across the entire corporate infrastructure, from head office to branch office.

The best intro i have seen to date has been from the Rob from TechWiseTV:

ISE Features & Benefits

• Visibility: Single Platform & Pane of Glass - Let IT see who and what is on the network for advanced discovery and troubleshooting
• Dynamically collects & consolidates endpoint information to make adaptive policy decisions based on ‘context’
• Integrates functions previously delivered in separate, loosely couples applications to deliver higher levels of policy enforcement 
• Inherent benefits include simplified administration, monitoring, and troubleshooting for all these functions
• Policy Architecture
• Context-aware enforcement: Gathers information from users, devices, infrastructure, and network services to enable organizations to enforce contextual-based business policies across the network
• Business-relevant policies: Create and enforce consistent policy from the head office to the branch office 
• Coordinated Profiling: Allows for profiling data to be tightly integrated in to access policies. E.g. LDAP user with personal iPad gets a different privilege than the same LDAP user with Organization Owned iPad 
• Mobile Device Security: Dynamically identify and provision the proper policies for tablets, smartphones, GFE, etc   
• Compliance: Create consistent policy across the infrastructure for corporate governance. 
• Addresses vulnerabilities on user machines through periodic evaluation and remediation to help proactively mitigate network threats such as viruses, worms, and spyware 
• Ensure configuration baselines are met
• Ensure patches and AV/AS definitions are up to date
• Efficiency: Increase IT staff productivity by automating labor-intensive tasks and simplifying service delivery
• Allows enterprises to authenticate and authorize users and endpoints via wired, wireless, and VPN with consistent policy throughout the enterprise
• Dramatically reduces cost of ownership with world-class monitoring and troubleshooting features designed to streamline operations for your helpdesk and support teams
• Compatibility: Cisco Infrastructure Integration AND a standards based platform 
• ISE integration is thoroughly tested systematically across all cisco switches 
• Because 802.1X is a standard, 3^rd party device support is inherit
• A Few of the Cisco Switch Features that help with deployment:
• Open Mode – Allow customers to deploy day 1 without causing any outages and ease with deployment and rollout of 802.1X
• Multi Authentication – Allows for hubs, desktop VMs, etc to use a single port to authenticate and apply differentiating policies
• Security Group Access (SGA) 
  

Packaging and Licensing

Cisco Identity Services Engine is available as either a physical or virtual appliance. The type of license is based on functionality.

• The Base license is intended for organizations that want to authenticate and authorize users and devices on their network. It includes AAA services, guest lifecycle management, compliance reporting, and end-to-end monitoring and troubleshooting.
• The Advanced license expands upon the BASE and enables organizations to make policy decisions based on user and device compliance. Advanced license features include device profiling, posture services, and security group access enforcement capabilities.

Summary

ISE will be the platform that enables organizations to finally utilize port security, deal with the ever evolving enterprise and ensure they are able to deploy in days/weeks vs. months/years. Check back for some detailed technical write-ups on configuration, best practices and use cases.


ISE Documentation

• Release Notes for the Cisco Identity Services Engine, Release 1.0 
• Cisco Identity Services Engine Network Component Compatibility 
• Cisco Identity Services Engine User Guide, Release 1.0 
• Cisco Identity Services Engine Hardware Installation Guide, Release 1.0  
• Cisco Identity Services Engine Sponsor Portal User Guide, Release 1.0 
• Cisco Identity Services Engine CLI Reference Guide, Release 1.0 
• Cisco Identity Services Engine API Reference Guide, Release 1.0 
• Cisco Identity Services Engine Troubleshooting Guide, Release 1.0 

Intrusion Prevention Best Practice - IPS Placement

Background

In today's organizations, attacks come from everywhere. As cliche as it sounds, networks are borderless and because of this organizations face more sophisticated threats. As networks evolve, many organizations struggle to have intrusion prevention or other security architecture evolve at the same pace. Visibility is everything: you must be able to detect and respond to threats before they cause significant damage. The following entry is all about how to gain visibility at the different areas of the network.

IPS Overview

Wikipedia defines Intusion Prevention Systems as a "network security appliance that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about said activity, attempt to block/stop activity, and report activity."

By deploying IPS, organizations are able to identify, classify, and stop malicious traffic, including worms, spyware / adware, network viruses, and application abuse before they affect business continuity.

Internet Border & DMZ

The most common place to insert IPS is at an organizations' internet border(s) and DMZ(s). The following represents some of the options for placement of an IPS to protect an internet border and DMZ.

IPS Outside of Firewall

This architecture places the IPS outside of the internet firewall.This architecture was one of the first proposed when IPS came to market, but is not very common for today's environments.

Pros:

• Early indication of reconnaissance/scanning activities
• Requires less interfaces to inspect traffic sourced/destined to the DMZ and Internal Network

Cons:

• Destination/Victims addresses will be NATed, causing research to determine which device inside the organization is being attacked. 
• Source/Attacker addresses from the inside of the organization will be NATed causing additional research to track down the source of any malicious traffic coming from the organization.
• Inspection of traffic that will be dropped by the firewall will create excess false positives.
• No visibility of insider traffic destined to dmz

Figure 1 - IPS Placed Outside of the Firewall

IPS Inside of Firewall for DMZ and Internal Network

This architecture places the IPS inside of the internet firewall protecting both the Internal Network and DMZ segments.

Pros:

• Only inspects traffic that the firewall allows into the network. (Minimizing False Positives)
• Events will include real IP addresses and not NATed IPs.
• Differentiate traffic to/from DMZ and Internal Segments.

Cons:

• Requires 2 IPSs or an IPS with enough interfaces to protect both segments.
• Traffic between internal and DMZ will be inspected twice.

Figure 2 - IPS Placed Inside the Firewall

IPS Software or Module in the Firewall

With the growing popularity of Unified Threat Management (UTM), this architecture is becoming extremely common. It places the IPS functionality inside the internet firewall protecting both the Internal Network and DMZ segments without a separate appliance.

Pros:

• No additional appliance required, saving rack space and energy.
• Events will include real IP addresses and not NATed IPs.
• Differentiate traffic to/from DMZ and Internal Segments.

Cons:

• Some manufacturers limit the throughput of integrated IPS (just be sure that the integrated IPS will support the required bandwidth)

Figure 3 - IPS Software or Module in the Firewall

Data Center

One of the most important assets an organization has is its data. Most data is stored on servers located in a data center. This is why placing IPS between users and the data center is becoming a must have for organizations.

Most designs will include placing the IPS at the most central point for the data center(typically distribution or core layers). The challenges faced when deploying IPS in data centers are making sure you keep the same levels of redundancy and throughput of the data center. This can be accomplished through using etherchannel load balancing of separate IPS Appliances. For more information on Cisco IPS in the Data Center with etherchannel load-balancing, please read Jamey Heary's blog post on the topic.

Remote Sites

Often forgotten, remote sites are an important part of an IPS deployment strategy. Advancements in WAN technology, like MPLS, allows for any to any access causing a gap in visibility. The challenges of deploying IPS to remote sites include: power, rack space, operations support, and cost. The following are the options associated with deploying IPS to remote sites:

IPS Appliance for each remote site

Pros:

• Full featured IPS
• Scalable bandwidth for all sizes of remote offices.

Cons:

• Cost for a dedicated appliance, rack space and power
• Management and Deployment of the appliance

IOS IPS running on the router at each remote site

Pros:

• Low Cost
• No Additional HW
• Manage with existing router management tools

Cons:

• Does not have full featured IPS code
• Limited number of signatures
• Can effect performance of the router 
• Must run supported software and router

IPS Module inside the router at each remote site

Pros:

• Full featured IPS
• Low Cost
• No additional rack mount units (module fits in the router)

Cons:

• Bandwidth is limited
• Must have a supported router

Summary

Determining where IPSs should be placed in an enterprise is a must do task. A single IPS on the internet border leaves organizations with a hard outer shell and chewy inside. Hopefully this gives you some more details on the areas (Data Center & Remote Sites) that you should focus on. If you have additional questions, please feel free to email me.

The opinions and information presented here are my PERSONAL views and not those of my employer. I am in no way an official spokesperson for my employer.

Cisco NAC vs. 802.1X

Background

Access Control is on the rise. A recent Gartner survey indicates that 50% of enterprises plan to implement 802.1X in their wired networks by 2011. Gartner believes that momentum will increase strongly, and that actual enterprise adoption will reach 70% by 2011. With that said, we have a lot of organizations evaluating the differences between Cisco NAC and Cisco 802.1X. Before we dive into the details of either solution, I thought it would be appropriate to compare the two.

Cisco NAC Overview

Cisco NAC Appliance (formerly Cisco Clean Access) was designed to use your organization's network infrastructure to enforce security policy compliance on all devices that attempt to gain access. You can use the Cisco NAC Appliance to authenticate, authorize, evaluate, and remediate wired, wireless, and remote users before they can access the network.

Features

• Recognize users, their devices, and their roles in the network
• Evaluate whether machines are compliant with security policies
• Enforce security policies by blocking, isolating, and repairing noncompliant machines
• Provide easy and secure guest access
• Simplify non-authenticating device access
• Audit and report whom is on the network

Cisco NAC Components

• NAC Manager - Central Policy Management
• NAC Server - Enforcement Point
• NAC Agent - Used for Authentication, Posture Assessment, and Remediation
• NAC Profiler - Endpoint Discovery/Profiling and Behavior Monitoring
• NAC Guest Server - Secure Guest Provisioning

Figure 1 - NAC Appliance Components

Authentication & Authorization

NAC can be deployed using in-band(IB) or out-of-band(OOB) modes. OOB is typically used for LAN deployments, while IB is used for VPN/Wireless deployments. 

With IB, authentication is performed at the NAC Server by forcing traffic through the CAS. Traffic is forced through the cas using VLANs or Routing(PBR, VRF, etc.). Authorization (after the user goes through authentication and posture assessment)  is performed through ACLs on the NAC Server.

With OOB, authentication differs based on whether the user is Layer 2 or Layer 3 adjacent to the NAC Server. If the user is layer 2 adjacent, then VLANs are typically used and SNMP is used as the control plane to assign the appropriate VLAN. If the user is layer 3 adjacent to the NAC Server, SNMP will be used to assign VLANs, but authentication segmentation is typically performed by using ACLs or VRFs. Authorization is performed using dynamic VLAN assignment.

802.1X Overview

802.1X is a port based authentication and access control protocol that allows for authentication & authorization of wired and wireless devices. 802.1X enforces policy compliance, controlling port access and tracking users. It asks the following questions:

• Who are you? - Machine and/or User Authentication
• Where can you go? - Based on authentication, the user is placed in the correct VLAN or a PBACL is used.
• What service level do you receive? - The user can be given a per-user access control list to explicitly restrict or allow access to specific resources on the network, or given specific QoS priority on the network.
• What are you doing? - Using the identity and location of the user, tracking and accounting can be better managed.

Features

• IEEE/Industry Standard (RFC3380, IEEE )
• Recognize users, their devices, and their roles in the network
• Provide easy and secure guest access
• Simplify non-authenticating device access
• Audit and report whom is on the network

802.1X Components

• Cisco ACS Server - Central Policy Management
  
• Network Switches - Enforcement Point
• 802.1X Supplicant - Client that provides credentials (Could be stand-alone or OS Supplicant)
  
• NAC Profiler - Endpoint Discovery/Profiling and Behavior Monitoring
  
• NAC Guest Server - Secure Guest Provisioning

Figure 2 - 802.1X Components

Enforcement

During authentication, traditional 802.1X keeps the port in a down state until authentication has been performed. If the newly created "Open Mode" or "Low Impact" mode is being used a vlan or PBACL can be used to enforce access restrictions.

For authorization, 802.1X uses VLANs or Port-Based ACLs(PBACLs) to enforce access-restrictions for devices. Policy can be different between the machine and user sessions. The switch acts as the enforcement point and uses RADIUS as a control plane with Cisco ACS.

Comparison of Cisco NAC & 802.1X 

Above you should notice some major differences between the two access control methods, but I would like to take you a little deeper and call out some of the major differences.

Posture

If you have a requirement of performing detailed posture assessment and remediation within the next 12 months than you must go with Cisco NAC Appliance. 802.1X does not perform posture and the two access control methods do not work together.

One major question that comes up regarding posture is determining whether a device is owned or furnished by the organization. With NAC, you can perform Active-Directory SSO or check for specific files/registry keys to determine if it is an asset. With 802.1X you can use Machine Authentication using certificates to determine if the asset is owned by your organization. So even though you cannot perform posture assessments, you can check whether the devices is your by validating a certificate that is issued only to authorized machines.

Components & Control Plane

The use of ACS Servers vs. NAC Appliances is a major difference. The use of RADIUS vs. SNMP is another. Does it really matter? In most cases, NO it does not. In some cases, administrators prefer to use ACS because they are experts in using it.

Some organizations "refuse" to install another agent onto their desktop, so having the option of running a supplicant that is native to the Operating System is a huge benefit of 802.1X.

Switch Requirements

Cisco NAC Appliance has a list of OOB supported switches and the list is very comprehensive. This means there is less chance you will have to upgrade hardware or IOS. In order to take advantage of the newer features that make 802.1X very easy to deploy, the switch support for 802.1X is a little more demanding of recent versions of code. Cisco has innovated around easing deployment of 802.1X and because of this, Cisco Switches are recommended(Stay tuned to the blog for more posts around these features).

802.1X is a standard and is supported on most switches vs. NAC OOB which requires Cisco switches

Network Changes

NAC network changes include SNMP configuration, new VLAN configuration, VRF and/or ACL configuration.

802.1X requires a standard access port template on each port, AAA configuration, radius configuration and potentially ACL Configuration.

NAC requires more initial configuration to perform authentication than 802.1X.

Deployment Methodology

With NAC cutover, authentication is a must on day 1 and posture is typically implemented in audit mode. If a user does not have a way of authenticating(no agent, not logged into domain, etc) the user would be stopped.

With 802.1X cutover, open authentication allows administrators to deploy with zero worries day 1. If a user does not have a supplicant or the MAC is not configured for MAB, the switchport will remain open.

Summary

The bottom line is that both deployments have their advantages. NACs ability to assess an endpoints compliance with policy and 802.1Xs ability to deploy day 1 without any headaches gives both options valid arguments. The real decision should be based on your environment.... Do you need posture? Do you have all 2900XLs? Can you install an Agent?

SOURCE: Multiple Sites on CISCO.COM

The opinions and information presented here are my PERSONAL views and not those of my employer. I am in no way an official spokesperson for my employer.

Cisco NAC Version Matrix

One popular request is a list of features that come along with the different versions out. Below is a comparison of all the major code revisions of Cisco NAC Appliance.

4.8 (LATEST)

* Support for Cisco NME-NAC Platforms
* Administrator Access Restriction
* Out-of-Band Logoff
* In-Band and Out-of-Band Filter Behavior Enhancements
* Fast-OPSWAT
* RADIUS Session Timeout
* Passive Re-assessment
* Reporting Enhancements
* Agent Customization
* Agent Authorizes CAS
* Field-Replaceable FIPS Card for HP-Based Cisco NAC Appliances
* Cisco NAC Windows Agent Version 4.8.0.32
* Mac OS X Agent Version 4.8.0.569
* Cisco NAC Web Agent Version 4.8.0.4
* Features Optimized/Removed in Release 4.8
* Supported AV/AS Product List Enhancements (Windows Version 83, Mac OS X Version 7)


4.7

* FIPS 140-2 Compliance
* New Hardware Platform Support
* Cisco NAC Appliance WAN Deployment Enhancements
* AD SSO Requirements for Windows 7
* Windows 7 Support on Cisco NAC Agent


4.6

* Posture Assessment Support for 64-Bit Windows Operating Systems
* Agent Localization Support for "Double-Byte" Languages
* Selective Application Privilege Support for Windows Operating Systems
* Accessibility Support Via the JAWS Screen Reader Interface
* Full UTF-8 Compliance
* Agent Log Recording and Retrieval
* Support for EVDO Client Machines
* Optimized Windows Operating System Support
* Agent Configuration XML File Upload Enhancement
* Cisco Log Packager Agent Log Compiler Application
* Agent Backward-Compatibility
* Agent Upgrade Optional When Upgrading Cisco NAC Appliance
* Cisco NAC Appliance Agent Reports Enhancement
* Cisco NAC Windows Agent Version 4.6.2.113
* Mac OS X Clean Access Agent Version 4.6.0.3
* Cisco NAC Web Agent Version 4.6.0
* Administrator Web Console Enhancements to Support Cisco NAC Agent
* Features Optimized/Removed
* Supported AV/AS Product List Enhancements (Windows Version 78, Mac OS X Version 3)


4.5

* Policy Import/Export
* CAM/CAS SSL Certificate Management Enhancement
* CAM/CAS Software Upload Page Enhancements
* Database Snapshot Upgrade Enhancement
* Clean Access Manager High Availability User Interface Enhancement
* CAM/CAS Support Log Level Settings Enhancement
* CAM/CAS High Availability Configuration Able to Detect Hard-Drive Failure
* Support for Wireless Out-of-Band Deployments
* Assign Restricted VLAN for OOB Client Machines When Disconnected
* Certified Device List/Online User List Enhancements
* Out-of-Band Shield Enhancement
* Out-of-Band Discovered Clients Cleanup
* Pre-Login Banner
* Strong Password Support for Root Admin Users
* External Authentication Server Support for Web Administrator Login
* Support for Cisco NAC Appliance/NME-NAC Platforms Only
* Web Upgrade Support Removed
* Default CAM Web Console Password Removed
* Windows ME/98/NT OS Support Removed
* Policy Import/Export
* CAM/CAS SSL Certificate Management Enhancement
* CAM/CAS Software Upload Page Enhancements
* CAS Fallback Behavior Enhancement
* CAS HA Pair Link-Detect Configuration Enhancement
* DHCP Failover Behavior Enhancement
* Cisco NAC Appliance API Enhancement
* Supported AV/AS Product List Enhancements (Version 74)


4.1

* CAS Policy Fallback
* Clean Access Agent/ActiveX/Applet DHCP Release/Renew
* Support for GPO Update Trigger
* Online Update to Retrieve Switch OIDs
* Qualified Remediation Program Launch
* Clean Access Agent for Mac OS X Authentication
* Clean Access Agent Installation Options
* Clean Access Agent Language Template Support
* Clean Access Agent Silent Auditing
* Searchable Clean Access Agent Reports
* Certified Devices Timer Enhancements for Periodic Assessment
* DHCP Renewal Enhancements
* DHCP Subnet List Enhancements
* DHCP Global Option Enhancements
* IE 7.0 Support
* Clean Access Agent Enhancements (4.1.0.0)
* Port Profile Management for OOB Users
* Enhancements to Check Parameters
* Daylight Savings Time Support
* Supported AV/AS Product List Enhancements (Version 42)
* Deprecated IPsec/L2TP/PPTP/PPP Features
* Deprecated Roaming Features
* Support for Windows Vista Operating System
* RADIUS Challenge-Response Support
* Layer 2 Traffic Policy Support
* Multiple Active Directory Server Support in AD SSO
* Restricted Administrator Web Console Options Hidden from View
* Proxy Server Basic/Digest/NTLM Authentication Support
* VLAN Profiles
* VLAN Pruning
* Event Logs Enhancement
* Agent Report Retrieval API Operation
* Out-of-Band IP Refresh Enhancement
* Switch Port Configuration Enhancements
* SNMP Receiver Settings Enhancement
* Support for Windows Vista Operating System
* Windows Update Upon Agent Login
* Agent Reports Show System and User Information
* Agent IP Address Refresh/Renew Enhancement
* CAS-Agent Discovery (SWISS) Enhancements
* 4.1.0.x Agent Support on Release 4.1(1)
* MAC OS RADIUS Challenge-Response Support
* MAC OS Automatically Close Message Dialog After Successful Login
* MAC OS IP Refresh Support for Out-of-Band Deployments
* MAC OS Allow Only One Mac OS Agent to Run on the Client at a Time
* Cisco NAC Appliance Integration with Cisco NAC Profiler/Collector Solution
* New Cisco NAC Network Module (NME-NAC-K9) Support
* NAC Appliance Platform Type Display
* Debug Log Download Enhancement
* Active VPN Client Status Page Enhancement
* WSUS Requirement Configuration Display Enhancement
* New "service perfigo platform" CLI Command
* Web Login Support Using Safari Browser for Mac OS
* Windows Clean Access Agent Language Template Support Enhancement
* Cisco NAC Web Agent
* Support for Clients with Multiple Active NICs
* Clean Access Server HA Heartbeat Link Enhancement
* Clean Access Manager HA Configuration and Heartbeat Link Enhancements
* Guest User Login and Registration Enhancements
* LDAP Authentication Enhancement
* Clean Access Server and WSUS Interaction Enhancement
* Agent Restricted User Access Enhancement
* Device Filter List Display and Import/Export Enhancement
* Agent Report Information Display and Export Enhancement
* VPN SSO Login Enhancement
* VPN SSO Enhancement to Support Existing Clientless SSL VPN Users Launching the AnyConnect Client from a WebVPN Portal
* Syslog Configuration Enhancement
* Debug Log Download Enhancement
* cisco_api.jsp Enhancement
* CSRF Protection
* Proxy Support Enhancements
* ARP Broadcast Packet Handling Improvement
* Clean Access Server HA ARP Broadcast Enhancement
* Deprecated "Retag Trusted-side Egress Traffic with VLAN (In-Band)" Feature
* Previously-Deprecated Features Removed from CAM/CAS Web Console Pages
* Clean Access Agent Auto Remediation
* Delay Agent Logoff on CAM/CAS
* 64-bit Windows Operating System Agent Support
* Access to Authentication VLAN Change Detection Enhancement
* SNMP Inform Notification Enhancement
* SNMP "MAC Move Notification" Switch Port Configuration Support
* Trusted Certificate Authority Enhancement for Production Environments
* Enhanced CAM/CAS Web Console Features Certificate Warning Messages
* Ability to View and Remove Certificate Authorities from CAM/CAS Without Rebooting
* Enhanced Security with Server Identity Based Authorization
* JMX Over SSL Secured with Mutual Authentication
* HTTPS Connections Enhanced with Mutual Authentication
* Features Optimized/Removed
* CAS Fallback Behavior Enhancement
* CAS HA Pair Link-Detect Configuration Enhancement http://www.cisco.com/en/US/i/templates/blank.gif
* DHCP Failover Behavior Enhancement


4.0

* Support for Active Directory (Windows Domain) Single Sign-On (SSO)
* Corporate Asset Authentication and Posture Assessment by MAC Address
* Support for Layer 3 Out-of-Band (OOB) Deployment
* New Windows Update Requirement Type
* SMP Kernel Support for Super CAM
* Support for Assigning VLANs by VLAN Name in OOB Deployments
* Support for "IGNORE" Global Device Filter for IP Phones in OOB Deployments
* Ability to Change Priority of Wildcard/Range Global Device Filters
* Ability to View or Search Active L2 Devices in Device Filter List
* Ability to Test MAC Addresses Against Device Filters
* Support for Relay IP Class Restrictions on DHCP Server
* Support for DHCP Global Actions
* New "service perfigo maintenance" CLI Command for CAS
* Ability of Clean Access Agent to Send IP/MAC for All Available Adapters
* Support for Stub Installation/Update of the Clean Access Agent
* OOB Page Redirection Timers (SNMP Receiver Advanced Settings)
* SNMP Enhancements for CAM
* CAS Host-Based Traffic Policy Enhancements for Proxy Servers
* Enhancements for DHCP Option Configuration Forms
* Authentication Cache Timeout
* Enable L3 Strict Mode
* OOB Support for 3750 NME Modules for Cisco 2800/3800 ISRs
* Link-Failure Based Failover in CAS HA
* Upgrade Enhancements
* CAM Disable Serial Login
* CAM Admin Console Login Enhancements
* Client OS Detection Signature Lookup
* Start Timer Specification for Cisco Updates
* API Enhancements
* Enhancements for Windows XP Media Center Edition/Tablet PC
* Restricted Network Access Option for Clean Access Agent Users
* Daylight Savings Time Support
* Support for Windows Vista Operating System
* License Manager Support for Cisco Clean Access Lite, Standard, and Super Managers
* Improved Memory Footprint for Clean Access Agent Reports
* Broadcast ARP Server Management Option Removed
* Kernel Upgrade
* Debug Log Download Enhancement
* Syslog Configuration Enhancement

The opinions and information presented here are my PERSONAL views and not those of my employer. I am in no way an official spokesperson for my employer.

Welcome

Today, organizations use IT to support their mission and business objectives. With the evolution of business through technology, organizations have proven that it can be an accelerator for growth, competitive differentiator, productivity enhancer and even strengthen employee satisfaction. The challenge organizations face is how to obtain these returns from the technology that they have invested in?

This blog hopes to help unlock some of the secrets of deploying or using technology in a way to obtain return on your investment: get the most out of the features; optimize your environment to save cost; secure your IT infrastructure;

Some of the core topics that you can count on from this Cisco Security Blog:

• Deployment Best Practices
• Upgrade Announcements & Procedures
  
• Gotchas & Workarounds
• Troubleshooting Tips
• Operationalizing Products

Unlike the Cisco NAC blog, CAYSEC will expand to covering Cisco ASA, IPS, SIEM, 802.1X, IronPort S-Series and C-Series(Web and Email), and router/switch security.

If you have comments/suggestions please contact me.

NAC Version 4.6.1 - Now Available

NAC Appliance Version 4.6.1 was release yesterday.

Some of the new features:

Posture Assessment Support for 64-Bit Windows Operating Systems

The new NAC Agent can be installed and launched on 64-bit versions of Windows XP and Windows Vista, and can perform posture assessment and remediation on client machines. Earlier releases of Cisco NAC Appliance provided only authentication support for 64-bit client operating systems.

Agent Configuration XML File Upload Enhancement

This XML configuration file method of setting up Agents on client machines replaces the previous Clean Access Agent configuration schema requiring Windows registry setting manipulation for custom parameters. No more registry changes, hooray!

If you previously employed Windows registry settings to adjust Clean Access Agent behavior on client machines, you must specify the same settings in the XML Agent configuration file to preserve Agent behavior using the Cisco NAC Agent.
This upgrade has a ton of new agent features, as you can see in the above images, so make sure to check out the release notes and read for yourself.

4.6.1 Release Notes

And to configure these features, please reference the configuration guides:

NAC Manager Config Guide
NAC Server Config Guide

Cisco NAC Guest Server 2.0

NAC Guest Server has changed significantly with the latest 2.0 release. From External Portal Support to AD SSO, this revision has added some key enterprise features.

The features that have hit home the most for myself and my customers have been:

Active Directory Single Sign On

Cisco NAC Guest Server 2.0 can be joined to an Active Directory Domain and then automatically authenticate Internet Explorer browsers using Integrated Windows Authentication. This removes the need for sponsors to enter their username and password.

For details on configuration of ADSSO, see the Configuration of Active Directory Single Sign-On for NAC Guest Server Configuration Example

Credit Card Billing Support

Cisco NAC Guest Server 2.0 provides the ability for guests to purchase accounts via credit card support.

This means that you can now use NGS to provide ROI for guest internet access.

Management Reports

Management reports are enhanced to provide the following guest network usage information:

•Total Guest Accounts Created
•Total Authenticated Guests
•Total Cumulative Connect Time
•Sponsor Usage Reporting
•Access Summaries by Device

To See a list of all the new features in NAC Guest Server 2.0, please read the the release notes:

http://www.cisco.com/en/US/docs/security/nac/guestserver/release_notes/20/gsrn20.html#wp65354

And to configure these features, please reference the configuration guide:

http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/20/nacguestserver.html

NAC NEWS UPDATES

The following is a list of new things out there in the Cisco NAC World. The NAC Market is continuing to grow in 2009 and with the growth the products will continue to evolve, get better and have more options.

Security Options Abound: New NAC Release

My friends over at TechWiseTV are a huge multi-media machine, producing video, audio and podcasts. Well this PodCast is on NAC 4.5, Alok Agrawal of the NAC Business Unit and Myself dive into some of the cool features of 4.5. All of the podcasts can be subscribed to through iTunes.

To access the NAC podcast go to:

http://www.cisco.com/en/US/solutions/ns340/ns339/ns638/ns719/html_TW/tw_episode_198.html

And to get more information on all the great stuff coming from Techwise TV visit:
http://www.mytechwisetv.com/
or
http://cisco.com/go/interact

NAC Layer 3 Out of Band Design Guide That Uses VRF-Lite for Traffic Isolation

Cisco wrote a new configuration guide on using VRF-Lite for traffic isolation. This is a great configuration option for NAC, but with that said never re-design your network just for NAC. VRFs can become very complex and introducing new technology into the network should be carefully planned. Using VRFs in a enterprise network does make sense, but the reasons for moving to the new network design should be a combination of the added features/benefits for Security(NAC, Guest Access, Wireless, etc.) and Network managebility, throughput, and scalability.

http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080a3a8a7.shtml

New NAC Profiler Release

Last month a new maintenance release of Cisco NAC Profiler came out. 2.1.8-38 brings a good list of BugFixes and minor enhancements.

One Minor Enhancement that made it was Endpoint and Directory Timeout Unified Into Endpoint Timeout, which gives us more control on how to age out endpoints out of the database.

Find all the Fixes and information in the Release Notes.

The Release Notes can be found:
http://www.cisco.com/en/US/docs/security/nac/profiler/release_notes/218/218rn.html#wp101317

The new software can be download at:
http://www.cisco.com/cgi-bin/tablebuild.pl/nacprofiler-2.1.8 (Requires Valid Smartnet Contract)

NAC Support Logs in 4.5

Many people might be wondering what happen to the handy dandy support logs that used to be located in the "/perfigo/logs/" directory in previous NAC versions. Well in version 4.5 there were some enhancements to the logging and with those enhancements came new placement of the logs.

These logs are most commonly used to troubleshoot NAC during deployments. Please do not turn on advanced logging without reading the documentation fully or with the assistance of Cisco TAC.

The CAM log can be found at:

/perfigo/control/tomcat/logs/nac_manager.log

The CAS log can be found at:

/perfigo/access/tomcat/logs/nac_server.log

For those of you not familiar with what the logs contain, please feel free to reference the CAM and CAS Configuration Guides:

CAM Admin Guide - Support Logs
CAS Admin Guide - Support Logs

NAC Version Matrix

In June of 2006, NAC Version 4.0.0 was released. Since then, Cisco has released numerous updates and features to the NAC Appliance line! Recently a member of the NAC Mailing List posted the following request:

Is there a feature matrix to compare the various versions/tracks of
Cisco NAC?

So that is exactly what this posts answers. It is long, but I know at least one person appreciates it!

I will explore 3 major lines of code.. 4.0.X, 4.1.X and 4.5.X. Realistically all new deployments should be using 4.1.X or 4.5.X, but I wanted to give a good overview for everyone on older codes.

4.0.X

4.0.0

• Support for Active Directory (Windows Domain) Single Sign-On (SSO)
• Corporate Asset Authentication and Posture Assessment by MAC Address
• Support for Layer 3 Out-of-Band (OOB) Deployment
• New Windows Update Requirement Type
• SMP Kernel Support for Super CAM
• Support for Assigning VLANs by VLAN Name in OOB Deployments
• Support for "IGNORE" Global Device Filter for IP Phones in OOB Deployments
• Ability to Change Priority of Wildcard/Range Global Device Filters
• Ability to View or Search Active L2 Devices in Device Filter List
• Ability to Test MAC Addresses Against Device Filters
• Support for Relay IP Class Restrictions on DHCP Server
• Support for DHCP Global Actions
• New "service perfigo maintenance" CLI Command for CAS
• Ability of Clean Access Agent to Send IP/MAC for All Available Adapters
• Support for Stub Installation/Update of the Clean Access Agent
• OOB Page Redirection Timers (SNMP Receiver Advanced Settings)
• SNMP Enhancements for CAM
• CAS Host-Based Traffic Policy Enhancements for Proxy Servers
• Enhancements for DHCP Option Configuration Forms
• Authentication Cache Timeout

4.0.1

• Enable L3 Strict Mode
• OOB Support for 3750 NME Modules for Cisco 2800/3800 ISRs
• Link-Failure Based Failover in CAS HA
• Upgrade Enhancements
• CAM Disable Serial Login
• CAM Admin Console Login Enhancements
• Client OS Detection Signature Lookup
• Start Timer Specification for Cisco Updates
• API Enhancements
• Enhancements for Windows XP Media Center Edition/Tablet PC

4.0.3

• Restricted Network Access Option for Clean Access Agent Users
• Daylight Savings Time Support

4.0.4

• Support for Windows Vista Operating System
• License Manager Support for Cisco Clean Access Lite, Standard, and Super Managers
• Improved Memory Footprint for Clean Access Agent Reports
• Broadcast ARP Server Management Option Removed
• Kernel Upgrade

4.0.6

• Debug Log Download Enhancement
• Syslog Configuration Enhancement

4.1.X

4.1.0

• CAS Policy Fallback
• Clean Access Agent/ActiveX/Applet DHCP Release/Renew
• Support for GPO Update Trigger
• Online Update to Retrieve Switch OIDs
• Qualified Remediation Program Launch
• Clean Access Agent for Mac OS X Authentication
• Clean Access Agent Installation Options
• Clean Access Agent Language Template Support
• Clean Access Agent Silent Auditing
• Searchable Clean Access Agent Reports
• Certified Devices Timer Enhancements for Periodic Assessment
• DHCP Renewal Enhancements
• DHCP Subnet List Enhancements
• DHCP Global Option Enhancements
• IE 7.0 Support
• Clean Access Agent Enhancements (4.1.0.0)
• Port Profile Management for OOB Users
• Enhancements to Check Parameters
• Daylight Savings Time Support
• Supported AV/AS Product List Enhancements (Version 42)
• Deprecated IPsec/L2TP/PPTP/PPP Features
• Deprecated Roaming Features

4.1.1

• Support for Windows Vista Operating System
• RADIUS Challenge-Response Support
• Layer 2 Traffic Policy Support
• Multiple Active Directory Server Support in AD SSO
• Restricted Administrator Web Console Options Hidden from View
• Proxy Server Basic/Digest/NTLM Authentication Support
• VLAN Profiles
• VLAN Pruning
• Event Logs Enhancement
• Agent Report Retrieval API Operation
• Out-of-Band IP Refresh Enhancement
• Switch Port Configuration Enhancements
• SNMP Receiver Settings Enhancement
• Support for Windows Vista Operating System
• Windows Update Upon Agent Login
• Agent Reports Show System and User Information
• Agent IP Address Refresh/Renew Enhancement
• CAS-Agent Discovery (SWISS) Enhancements
• 4.1.0.x Agent Support on Release 4.1(1)
• MAC OS RADIUS Challenge-Response Support
• MAC OS Automatically Close Message Dialog After Successful Login
• MAC OS IP Refresh Support for Out-of-Band Deployments
• MAC OS Allow Only One Mac OS Agent to Run on the Client at a Time

4.1.2

• Cisco NAC Appliance Integration with Cisco NAC Profiler/Collector Solution
• New Cisco NAC Network Module (NME-NAC-K9) Support
• NAC Appliance Platform Type Display
• Debug Log Download Enhancement
• Active VPN Client Status Page Enhancement
• WSUS Requirement Configuration Display Enhancement
• New "service perfigo platform" CLI Command
• Web Login Support Using Safari Browser for Mac OS

4.1.3

• Windows Clean Access Agent Language Template Support Enhancement
• Cisco NAC Web Agent
• Support for Clients with Multiple Active NICs
• Clean Access Server HA Heartbeat Link Enhancement
• Clean Access Manager HA Configuration and Heartbeat Link Enhancements
• Guest User Login and Registration Enhancements
• LDAP Authentication Enhancement
• Clean Access Server and WSUS Interaction Enhancement
• Agent Restricted User Access Enhancement
• Device Filter List Display and Import/Export Enhancement
• Agent Report Information Display and Export Enhancement
• VPN SSO Login Enhancement
• VPN SSO Enhancement to Support Existing Clientless SSL VPN Users Launching the AnyConnect Client from a WebVPN Portal
• Syslog Configuration Enhancement
• Debug Log Download Enhancement
• cisco_api.jsp Enhancement
• CSRF Protection
• Proxy Support Enhancements
• ARP Broadcast Packet Handling Improvement
• Clean Access Server HA ARP Broadcast Enhancement
• Deprecated "Retag Trusted-side Egress Traffic with VLAN (In-Band)" Feature
• Previously-Deprecated Features Removed from CAM/CAS Web Console Pages
• Clean Access Agent Auto Remediation
• Delay Agent Logoff on CAM/CAS
• 64-bit Windows Operating System Agent Support
• Access to Authentication VLAN Change Detection Enhancement
• SNMP Inform Notification Enhancement
• SNMP "MAC Move Notification" Switch Port Configuration Support

4.1.6

• Trusted Certificate Authority Enhancement for Production Environments
• Enhanced CAM/CAS Web Console Features Certificate Warning Messages
• Ability to View and Remove Certificate Authorities from CAM/CAS Without Rebooting
• Enhanced Security with Server Identity Based Authorization
• JMX Over SSL Secured with Mutual Authentication
• HTTPS Connections Enhanced with Mutual Authentication
• Features Optimized/Removed

4.5.X

4.5.0

• Policy Import/Export
• CAM/CAS SSL Certificate Management Enhancement
• CAM/CAS Software Upload Page Enhancements
• Database Snapshot Upgrade Enhancement
• Clean Access Manager High Availability User Interface Enhancement
• CAM/CAS Support Log Level Settings Enhancement
• CAM/CAS High Availability Configuration Able to Detect Hard-Drive Failure
• Support for Wireless Out-of-Band Deployments
• Assign Restricted VLAN for OOB Client Machines When Disconnected
• Certified Device List/Online User List Enhancements
• Out-of-Band Shield Enhancement
• Out-of-Band Discovered Clients Cleanup
• Pre-Login Banner
• Strong Password Support for Root Admin Users
• External Authentication Server Support for Web Administrator Login
• Support for Cisco NAC Appliance/NME-NAC Platforms Only
• Web Upgrade Support Removed
• Default CAM Web Console Password Removed
• Windows ME/98/NT OS Support Removed

Bottom Line, I recommend 4.1.6 for any new deployment that does require any of the features of 4.5.X

Cisco NAC Appliance 4.5 Released

The time has come.... 4.5 is here

It can be downloaded here! (Require Valid Smartnet Contract)

As with all NAC releases, be sure to read the RELEASE NOTES before upgrading!

CAM/CAS Configuration Guides:

• Cisco NAC Appliance - Clean Access Manager Installation and Configuration Guide, Release 4.5 New!
  
• Cisco NAC Appliance - Clean Access Server Installation and Configuration Guide, Release 4.5 New!

Bottom line is that 4.5 brings way too many features to list. That is why the release notes will help!

Looks for future posts on new features and benefits!

Configuration Example - Wireless Out Of Band - New NAC 4.5 Feature

The following is a configuration guide that was posted to explain how to configure NAC 4.5 with Wireless LAN Controller 5.1 for NAC Wireless OOB support.

NAC Out-Of-Band (OOB) Wireless Configuration Example

Wireless OOB is a feature we all have been waiting for. Some of the great benefits that I see are:

- No need for a second Clean Access Server(CAS) just for wireless. If you are a smaller organization wireless and wired can be performed on a single CAS.
- Bandwidth benefits for larger wireless infrastructures. With 10Gbps network backbones and large central wireless deployments(lots of clients), having a OOB wireless deployment is a no brainer.

This is one of a few great features coming out with NAC release 4.5.

Coming Soon - Cisco NAC Release 4.5

Cisco is preparing for NAC Release 4.5 which will include great features like Wireless OOB, Mac Posture Assessment Support and CAM import/export of policies.

The first piece of documentation has been published:

Cisco NAC Appliance Release 4.5 - Video Data Sheet

Keep a lookout for posting on all the new features and when the download becomes available.

NAC Updates

Windows Clean Access Agent Version 4.1.7 Released - Sept 30th

In this release their are a few minor resolved caveats:

- Symantec AntiVirus 10.x not fully compatible with CCA Agent
- Vista Agent does not detect MAC Address of Wireless NIC
- AVG Anti-Virus Free 8.x support for Virus Definition check

As with all upgrades, it is highly recommended to read the release notes before upgrading. Also, on a side note, remember that upgrades should be done for a purpose, either to fix a caveat or to gain new features.

Download 4.1.7 Windows Agent

Release Notes


3 NEW Configuration Examples posted to CCO

- NAC Appliance (CCA): Configure High Availability (HA) for the Clean Access Manager (CAM)
29/Sep/2008

- Deploy NAC Profiler in an Existing Out-of-Band NAC
02/Sep/2008

- Importing SSL Certificates to NAC Profiler
02/Sep/2008


To see all the previous Configuration Examples and TechNotes


How to Block Operating Systems with CCA

A friend of mine, Rob Chee, writes a blog on network security and had a great post on how to block operating systems using User Pages with CCA.

Make sure you check out his Post.

New Configuration Example: Configure Guest Access

Cisco posted a new Configuration Guide:

NAC: Configure Guest Access
This example will walk you through how to configure the various types of guest access on the Cisco Clean Access or NAC appliance.


To see all the previous Configuration Examples and TechNotes

NEW NAC Version 4.1(6)

4.1.6 is available and you can download it here:

Cisco NAC Appliance Software Download Page
Requires a valid Smartnet contract in order to download



4.1(6) Release Notes
As with all NAC Upgrades, the release notes are extremely important!

4.1(6) CAM Installation & Configuration Guide

4.1(6) CAS Installation & Configuration Guide

Ask the Expert - Cisco NAC Guest Server

Click Here to Begin

This is a great forum to ask your NAC Guest Server questions. Syed is apart of the stellar NAC business unit and focuses on Guest Server. Please read the detailed description below:

This is an opportunity to get an update on the new Cisco NAC Guest Server which works with either Cisco NAC Appliance or Cisco wireless LAN controllers to manage the entire lifecycle of guest access with Cisco expert Syed Ghayur. Syed is a technical marketing engineer in the product marketing team for the Cisco Network Access Control (NAC) Appliance. He also works on global scalability of the product, documentation, partner training, and system engineer trainings. In addition, he works closely with the Cisco Technical Assistance Center (TAC) to resolve complex issues and product related bugs. Early this year, he joined the Security Technology Group (STG) as technical marketing engineer for NAC Appliance.

Remember to use the rating system to let Syed know if you have received an adequate response.

Syed might not be able to answer each question due to the volume expected during this event. Our moderators will post many of the unanswered questions in other discussion forums shortly after the event. This event lasts through July 25, 2008. Visit this forum often to view responses to your questions and the questions of other community members.

NAC Manager (CAM) Backups

Background:

The Cisco NAC Manager is the brain of the Cisco NAC solution. All configuration is stored in a database which makes the solution scalable. With that said, a crucial step in any deployment is developing a backup plan to ensure that if the NAC Manager or Failover Pair fails(Hardware failure, database corruption, administrator configuration mistake, fire, flood, sinkhole, etc.) the database can be restored and everything will be back up and working!


What gets backed up:

Everything that is stored in the database gets backed up. The following is a list of items that get backed up:

o Clean Access Server Configuration information (DHCP, Managed Subnets, VLAN Mapping, Static Routes, filters, etc.)
o Filters (Device Filters, Subnet Filters)
o Posture Assessment (Checks, Rules, Requirements,etc)
o Switch Management
o User Management (User Roles, Auth Servers, User Pages, Admin Users)
o Reports
o Licenses


What doesn't get backed up:

The less talked about item is what is not backed up. The following is a list of things that must be backed up manually during deployment and are not included in the database backup:

o Initial Configuration Information (service perfigo config) for the Managers and Servers. This means that good documentation of the initial network placement and ip addresses is a MUST.
o Failover Configuration (Good documentation will be the solution)
o Certificates (This is the #1 forgotten piece of information) Make sure to backup the private keys, root certificates, and CAM/CAS Certificates


Manual Backups:

The NAC Manager supports manual backups by going to administration -> backup, name the snapshot and hit "Create Snapshot". The snapshot may be downloaded to the local pc, if desired.

Figure 1 – Manual Backups

Automatic On-Box Backups:

The NAC Manager automatically creates daily snapshots of the Clean Access Manager database and preserves the most recent from the last 30 days. It also automatically creates snapshots before and after software upgrades, and before and after failover events. No configuration is required to enable these automatic backups. These backups are stored at /perfigo/backup directory.

Figure 2 – Automatic On-Box Backups

Automatic Off-Box Backups:

The first two methods are great, but what happens if the CAM gets caught in a fire? This is why creating a backup strategy to include automatically sending backups to another device that will not take the same hit as the CAM(Think different location) is vital. Cisco has provided a script located on the CAM(/perfigo/control/bin/) called pg_backup that will take a database backup and send it to an external FTP server. The following is a list of procedures to use the pg_backup script to send your DB backup to a ftp server nightly(See example for details):

o Login to the CAM as root
o cd /perfigo/control/bin
o Test using the pg_backup script
o Create a crontab file to use with cron (Example shows running pg_backup every morning at 2:30am)
o Import the crontab file
o Verify the file imported correctly

Figure 3 – Automatic Off-Box Backups

If ftp is not available within an organization SCP/NFS/SFTP may be utilized by creating a custom backup script or hiring a consultant to create one for the organization. Also, please note the pg_backup script names the file "csdb.gz". In order to keep multiple backups, create a backup rotation script on the ftp server or modify pg_backup to include a date.

Summary:

Backups are vital to ensuring NAC will be up and running quickly through any failure. Be sure with any deployment a strong backup strategy is included.

Sources: CAM Installation & Configuration Guide v4.1.3

Coming Up Next: Restores

Happy Cisco-Live week to everyone attending in Orlando and make sure to sign up for the NAC Deployment or NAC Troubleshooting session.