Solution Profile: Cisco NAC Appliance
Cisco Systems offers two distinct NAC solutions.
Its NAC Framework enables organizations to create a comprehensive, universal and highly automated infrastructure for enforcing endpoint security compliance and controlling network admission policies. While Cisco provides the central NAC policy controller and NAC-enabled network systems more than 50 vendors provide complementary endpoint security and management software that integrates with the Cisco products. Deploying and managing a Cisco NAC Framework is a major undertaking which requires a substantial investment in hardware, software, services and manpower. View NAC Framework Profile.
In contrast, the NAC Appliance, formerly called Cisco Clean Access, enables organization to rapidly deploy relatively self-contained endpoint assessment, policy management, and remediation services without requiring changes to switches and routers. The NAC Appliance capabilities are much narrower than a full-blown NAC Framework implementation and the required effort, time and costs are naturally much lower.
|
Which Cisco NAC solution should you choose? Cisco recommends the NAC Appliance unless one of the following conditions exist:
|
Functional Description
The NAC Appliance provides the following primary functions:
- Challenges all users with a log-on screen whenever they attempt to access the network
- Acts as a proxy for all types of user authentication
- Authenticates devices using MAC addresses and link them to the users
- Restricts device traffic to NAC-related activities until authorization is granted
- Performs either network- or agent-based scans to verify security policy compliance
- Runs compliance checks on all devices including non-user devices (e.g., printers)
- Restricts non-compliant endpoints to a quarantine LAN and notifies users of connection status and required action
- Does NOT selectively control user access privileges with role-based policies
- Compliance checking can be scheduled to occur every time access is attempted or at pre-determined time intervals; this requirement and the type of compliance checking can be varied by user role (e.g., executive, general employee, guest)
- The NAC Appliance can be deployed in the network either inline or out-of-band (in the latter case it communicates with any switch over SNMP)
- Network scanning works on all devices; the agent scan is only available on Windows
- All remediation steps are manual for the user with the exception of the Cisco Security Agent which can be "updated" automatically. The Cisco Security Agents resides on endpoints, protecting them from day-zero attacks through host intrusion prevention technology.
- Rogue devices are blocked by MAC address filtering which blocks IP spoofing
- NAC enforcement can be located anywhere - at the edge, LAN/LAN, and WAN/LAN points in the network
- 802.1x support is NOT required
- the Cisco NAC Appliance is pre-packaged with automatic checks from most major antivirus and antispyware vendors, as well as with Microsoft updates. Custom checks are easily added.
- The Cisco Security Agent is free.
- Redundant NAC Appliance configurations are available and should be viewed as essential
- In the case of a failed Windows hotfix, the Cisco NAC Appliance can automatically launch the Windows AutoUpdate tool. If the Cisco NAC Appliance detects an infection or vulnerability, it can push a fix tool to the user (Symantec's MyDoom Fix Tool, for example) and require that user to use it before accessing the network. In addition, any registry setting that is detected can trigger the download of software or scripts that secure the user's device to meet established security policies. the Cisco NAC Appliance is preconfigured with an update mechanism that supports critical Windows updates and antivirus definition updates from most major antivirus vendors.
Key Solution Components
The Cisco Clean Access solution consists of three components:
- Cisco Clean Access Server. This is an in-band or out-of-band device that acts as the first challenge for any end user trying to access the network. The Cisco Clean Access Server challenges the end user with a login page or requires the download of a Cisco Clean Access Agent before permitting access to the network.
- Cisco Clean Access Manager. This server manages Cisco Clean Access Servers remotely, globally, or individually and enables administrators to establish user roles, device checks, and remediation requirements. It also acts as the authentication proxy to the authentication servers that reside on the back end.
- Cisco Clean Access Agent. This is an optional client-side component of the Cisco Clean Access system. It is a read-only client that delivers device-based registry scans. The agent also can act as a remediation "wizard," automating the otherwise Web-based "click-through" process of cleaning a machine. It is downloadable and provisioned over the Internet.
Since Cisco provides a large amount of technical information about the NAC Appliance on its own web site these details are not repeated on Secure Access Central.
How The Cisco NAC Appliance Works
In the following example a remote user is accessing the network using either a VPN concentrator or an SSL VPN gateway. The Clean Access Server is deployed inline upstream of these perimeter security systems.
 |
||||
|
NAC Clients
|
Cisco Network Access Devices
|
NAC Servers
|
||
| Key NAC Solution Components |
|
|
|
|
Image Source: Cisco Systems