NAC Appliance and NAC Framework - ambiguous quires

I have gone through couple of resources about Network Admission Control (NAC)

I am looking for a correction to my understanding, because I got little bit confused

There are two admission control solution choices :
1 NAC Appliance (standalone box)
2 NAC Framework

NAC Framework (2) includes the following main components :
a- Endpoint security application
b- Posture agent
c- Network access devices
d- Cisco Policy server [Cisco Secure Access Control Server (CS ACS)]
e- Optional servers that operate as policy server decision points and audit servers
f- Optional management and reporting tools are highly recommended

Q1- NAC Appliance it standalone box ,,,,does that mean that NAC appliance includes (built-in) all the necessary (not optional) components , which are belong to NAC Framework (please see above) ?

Q2- The architecture of NAC Framework includes many different components from Cisco and other vendors (third party),,,,,,What about NAC appliance does it also include same components from other vendors (third party) ?

Q3- How does NAC appliance get updated ? since it is standalone box ? do we have to connect it to net to get the necessary updates ?

Q4- If I am looking to implement (install) NAC Appliance within my network do I need to use CS ACS (I guess we do not need to use CS ACS, see link below) or I have to use other components ?
Customers are recommended to consider the NAC Framework only when one of the following applies:
Cisco Secure Access Control Server (ACS) is required as the central policy server in the NAC deployment

Q5- The initial release of cisco NAC Framework became available June 2004 ,,,,what about NAC Appliance ? (i.e is it new technology )?

Q6- I could not get what does he mean by : words ? in-band ? and ? inline? in the above quote ?
NAC Appliance must be deployed as an in-band deployment to support WLANs. In an [b]in-band[/b] deployment, the NAC Appliance server is always [b]inline[/b] with user traffic-before, during, and after authentication, posture assessment, and remediation.
Who is Participating?
In general: the NAC appliance is a quick way to implement NAC without going through all the changes & investments to implement the full NAC Framework
It's an entry path.
Q1: Yes
Q2: No, only Cisco
Q3: It has a CD-rom drive. Basically they are HP Proliant with Cisco software.
Q4: No, the appliance acts as an authentication proxy, integrating with your existing authentication infrastructure & protocols (RADIOS, Ldap, Kerberos, AD ...). So it does not need CS ACS.
Q5: It was released July 2006. And it's an evolution of the earlier Cisco Clean Access which was released exactly one year earlier.
Q6: In band = physically between the monitored device and the rest of the network. Inline in the above quote is just the normal English meaning: the device is always in sync or in control. Out of band = logical seperation using other means to block network access then physically denying access. E.g. redirecting to an isolated VLAN, assigning a special subnet ...

zillahAuthor Commented:
Good shot J, This is just what I wanted.

>>Q5: It was released July 2006. And it's an evolution of the earlier Cisco Clean Access which was released exactly one year earlier.<<
Could you kindly refer me to some documentation for future reference ?

Two more questions, if you look to the title (NAC Appliance) of the Figure 1 in the link below :

Q7- As you have answered Q4 that  NAC Appliance does not need additional components, what I have noticed in the Figure 1 (please see the link above) that there are additional components (e.g Clean Access Manager , by the way iss it different from Cisco Clean Access ? ) ? what are they ? Yes I am aware that Cisco Clean Access is another name for NAC Appliance.

Q8- Since Network Access Devices are required components for NAC Framewaork, Are they required for NAC Appliance (Cisco Clean Access) as well ?

Q5: &

Q7: the CAM is a the server software to manage the CAS (Clean Acces Server). You need the CAM to define the rules, policies, etc ... It can be on the same machine, but can also centrally manage several CAS's.

Q8: I'm not sure what you are asking here. All networks have network access devices (routers, switches, AP's, firewalls ...).

Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

zillahAuthor Commented:
>>Q5: &<<
These link refers to when NAC Appliance V4 was released , it does not refere to when the first version of NAC Appliance was released.

To my knowledge version 3.5 was the first release of the appliance, half 2005.
But I have been known to be wrong, rarely, but it happens ;-)

zillahAuthor Commented:
>>Q3- How does NAC appliance get updated ? since it is standalone box ? do we have to connect it to net to get the necessary updates ?<<
Just to share with you what I have been told as well.
(( The NAC Appliance gets updated as per configured schedule, in our case, once an hour, via CCO and it can
do this via a Proxy too for preconfigured checks for over 200 products. The actual update and most of the configuration is done on the Manager Appliance, which controls one or more NAC appliances ))

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.