Link to home
Start Free TrialLog in
Avatar of zillah
zillahFlag for Australia

asked on

NAC Appliance and NAC Framework - ambiguous quires

I have gone through couple of resources about Network Admission Control (NAC)
http://www.cisco.com/en/US/netsol/ns466/netqa0900aecd800fdd6f.html
http://www.ciscopress.com/articles/article.asp?p=662903&seqNum=4&rl=1
http://www.consentry.com/products_features_nac.html

I am looking for a correction to my understanding, because I got little bit confused

There are two admission control solution choices :
1 NAC Appliance (standalone box)
2 NAC Framework

NAC Framework (2) includes the following main components :
a- Endpoint security application
b- Posture agent
c- Network access devices
d- Cisco Policy server [Cisco Secure Access Control Server (CS ACS)]
e- Optional servers that operate as policy server decision points and audit servers
f- Optional management and reporting tools are highly recommended

Q1- NAC Appliance it standalone box ,,,,does that mean that NAC appliance includes (built-in) all the necessary (not optional) components , which are belong to NAC Framework (please see above) ?


Q2- The architecture of NAC Framework includes many different components from Cisco and other vendors (third party),,,,,,What about NAC appliance does it also include same components from other vendors (third party) ?


Q3- How does NAC appliance get updated ? since it is standalone box ? do we have to connect it to net to get the necessary updates ?


Q4- If I am looking to implement (install) NAC Appliance within my network do I need to use CS ACS (I guess we do not need to use CS ACS, see link below) or I have to use other components ?
http://www.cisco.com/en/US/netsol/ns466/netqa0900aecd800fdd6f.html
[quote]
Customers are recommended to consider the NAC Framework only when one of the following applies:
Cisco Secure Access Control Server (ACS) is required as the central policy server in the NAC deployment
[/quote]


Q5- The initial release of cisco NAC Framework became available June 2004 ,,,,what about NAC Appliance ? (i.e is it new technology )?




Q6- I could not get what does he mean by : words ? in-band ? and ? inline? in the above quote ?
http://www.cisco.com/en/US/netsol/ns466/netbr0900aecd80355b2f.html
[quote]
NAC Appliance must be deployed as an in-band deployment to support WLANs. In an [b]in-band[/b] deployment, the NAC Appliance server is always [b]inline[/b] with user traffic-before, during, and after authentication, posture assessment, and remediation.
[/quote]
ASKER CERTIFIED SOLUTION
Avatar of PowerIT
PowerIT
Flag of Belgium image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of zillah

ASKER

Good shot J, This is just what I wanted.

>>Q5: It was released July 2006. And it's an evolution of the earlier Cisco Clean Access which was released exactly one year earlier.<<
Could you kindly refer me to some documentation for future reference ?

Two more questions, if you look to the title (NAC Appliance) of the Figure 1 in the link below :
http://www.cisco.com/en/US/netsol/ns466/netbr0900aecd80355b2f.html

Q7- As you have answered Q4 that  NAC Appliance does not need additional components, what I have noticed in the Figure 1 (please see the link above) that there are additional components (e.g Clean Access Manager , by the way iss it different from Cisco Clean Access ? ) ? what are they ? Yes I am aware that Cisco Clean Access is another name for NAC Appliance.

Q8- Since Network Access Devices are required components for NAC Framewaork, Are they required for NAC Appliance (Cisco Clean Access) as well ?

Regards
Q5: http://www.cisilion.com/cisco-nac-4.htm & http://www.cisilion.com/cisco-clean-access.htm

Q7: the CAM is a the server software to manage the CAS (Clean Acces Server). You need the CAM to define the rules, policies, etc ... It can be on the same machine, but can also centrally manage several CAS's.

Q8: I'm not sure what you are asking here. All networks have network access devices (routers, switches, AP's, firewalls ...).

J.
Avatar of zillah

ASKER

>>Q5: http://www.cisilion.com/cisco-nac-4.htm & http://www.cisilion.com/cisco-clean-access.htm<<
These link refers to when NAC Appliance V4 was released , it does not refere to when the first version of NAC Appliance was released.

To my knowledge version 3.5 was the first release of the appliance, half 2005.
But I have been known to be wrong, rarely, but it happens ;-)

J.
Avatar of zillah

ASKER

>>Q3- How does NAC appliance get updated ? since it is standalone box ? do we have to connect it to net to get the necessary updates ?<<
Just to share with you what I have been told as well.
(( The NAC Appliance gets updated as per configured schedule, in our case, once an hour, via CCO and it can
do this via a Proxy too for preconfigured checks for over 200 products. The actual update and most of the configuration is done on the Manager Appliance, which controls one or more NAC appliances ))

Regards