Doesnot work of digitization of the NAC

Similar Questions

• WiFi and bluetooth works is not on the computer.

  When I change my hard drive internal, then my laptop wifi and bluetooth doesnot work, not show in the Device Manager, so I use the broadcom wireless card... Please help me...

  Oh there there, I am user of HP... and I have windows 7

  Click here page Hp Driver

  It is a hyperlink... Once u click on this hyperlink to the front page of the HP driver automatically...

  give your serial number or find your laptop model... To see the updates...

• Help the NAC OOB Windows SSO

  We have just upgraded to Windows 2003 AD to Win2k8 R2 and Single Sign it has stopped working. Authentication works very well, but the NAC agent does not use the Windows credentails. Users must enter their user name and password manually.

  The AD server is a new server but has the same IP addresses as the old man. I'm running the CAM/CASE 4.7.2.

  Gregg

  Gregg,

  2 k 8 does not by default, so I suspect that is where it's a failure. Please look at the following sections and rerun ktpass (on a new user preference) as shown in the link:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/47/CAs/s_adsso.html#wp1257882

  HTH,

  Faisal

  --

  If you find this article useful, please note so that others can easily find the answer

• Version of the NAC

  Dear,

  Can what version of the NAC I install VMware?

  Can anyone help please with the above query.

  Thank you

  NAC is not supported on Vmware. Yet people have managed to install NAC4.1 on Vmware, but newer version do not work.

  There is a new product called Cisco ISE, which will eventually replace the NAC. Cisco ISE can be installed on Vmware.

• Ports of the NAC

  Hello Experts,

  Have some questions that came across while doing work of the NAC at one of our subsidiaries. If there is some user ports which are not selected for the profile of the NAC, is it possible (except physical control on the cell phone of the user by allowing all ports & audit) which can be used to track the paths of users without mail for NAC.

  Second, if the user of the NAC port is manually on the vlan user (rather than quarantine or vlan temporary), which is the correct order for that.

  the user on NAC field must be typed manually to vlan user or port profile should try not controlled followed by rebound port & update.

  Apprecite all help, thank you.

  Hello

  See online:

  If there is some user ports which are not selected for the profile of the NAC, is it possible (except physical control on the cell phone of the user by allowing all ports & audit) which can be used to track the paths of users without mail for NAC.

  [Tiago] On the graphical interface of CAM, you can check which controlled uncontrolled ports are. It is the only place where ports can be determined to be managed/no managed.

  Second, if the user of the NAC port is manually on the vlan user (rather than quarantine or vlan temporary), which is the correct order for that.

  the user on NAC field must be typed manually to vlan user or port profile should try not controlled followed by rebound port & update.

  [Tiago] When you perform the configuration of the switch, the switchports can be put on the vlan user or default access vlan. It depends on the port profile settings that you have configured. By default, when a port is managed on the basis, if a client connects, an SNMP trap is sent to the CAM. The CAM check whether the machine is certified or not (check the mac address). If the machine is not certified cam becomes the vlan the authenticated vlan configured on the port profile.

  So, whenever you connect a PC to a switchport, CAM evaluates what is the vlan correct the PC to start and change it accordingly.

  HTH,

  Tiago

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• Actual gateway IP process to strip the NAC

  Hi all

  I did a lot of research, and I can not find good answers to some of my questions. All the big questions are answered for out-of-band configuration, but I find that it is assumed that this understanding in the Strip is taken for granted lol... I guess I'm slow = P

  1. How does the gateway IP In-band real?
  2. What is the point of the 30 subnets?
  3. Are there any access/auth pairs VLAN configurations in the band?
  4. How does quarantine work?
  5. I read that the NAC server cannot send traffic on untrusted port to a VIRTUAL LAN and that you are not allowed to trunk port. This means that there is no support for several VLAN reliable, mapped to a single server at the NAC?
  6. Can you do role with configurations mapping in the band?

  Assistance for all or part of these questions would be GREATLY appreciated!

  Thank you a lot =]

  ~ Xavier.

  Hi Xavier,.

  I'll try to answer your questions

  1. How does the Strip Real-IP Gateway?

  The CASE works in routed mode, if you have different IP addresses (on different subnets) on interfaces approved and unapproved. Because the CASE does not support routing protocols, routing must be configured through static routes

  2. What is the point of the 30 subnets?

  The idea is to have small subnets for your customers so that with this config IP customers in authentication VLAN should through the CASE even to talk to other clients on the same subnet L2.

  Click here for an explanation:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/47/CAs/s_dhcp.html#wp1057889

  3 is there access/auth pairs VLAN configurations in the band?

  If you ask if there is mapping VLAN, then the answer is NO, as the purpose of the VLAN mapping must * bridge * traffic between approved and unapproved mapped VLAN, but in real-IP the L3 routing traffic CASES.

  4. How does quarantine work?

  When a client is quarantined, it works the same way as OOB, as in this phase, the client is always online to the CAs.

  So the concept is assigned to the CASE by the temporary user or the role of midlife and he applies a traffic policy you've set up temporary or the role of midlife.

  5. I have read that the NAC server cannot send traffic on untrusted port to a VIRTUAL LAN and that you are not allowed to trunk port. This means that there is no support for several VLAN reliable, mapped to a single server at the NAC?

  The restriction of VLAN "single" for Real - IP CASE applies only to the * trust * side. The CASE may be the default gateway for several subnets VLAN / IP on the * rogue * side.

  Configuring addresses VLAN / additional IP on the unreliable side by using the configuration "managed subnet.

  This is mentioned here:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/45/CAs/s_deploy.html#wp1050938

  The clean access server can manage one or more subnets, with its untrusted interface, acting as a gateway for managed subnets. For more information on the setup of managed subnets, see Configuring managed subnets or static routes page 5-26.

  6. can you do role with configurations mapping in the band?

  Yes, you can do it! However, you cannot assign a VLAN as you do in OOB, but you can assign the different level of access based on IP traffic strategies and bandwidth restrictions that you assign the specific role.

  For example, check here for more details:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/45/cam/m_users.html#wp1040231

  In a Word, regardless of the use of the band vs OutOfBand:

  -customers are InBand before CAs in CASE detection, authentication, the phases of assessment and remediation of posture.

  The main difference occurs when the user is allowed to access the network and that you run the IB role assignment and OOB but... :

  -in customer traffic keeps on inline flowing to the IB CAs, so you can apply different access policies (ACL) and control of bandwidth depending on the role policies (but you cannot assign a VLAN);

  -in OOB, customer traffic bypasses the CASE once it is authorized: in this case, you can apply different VLAN but (given that the CASE is no longer along the way) you cannot apply ACL and/or ensuring the policy in this case.

  I hope that answers your questions.

  Kind regards

  Federico

  --
  If this answers your question please mark the question as "answered" and write it down, so other users can easily find it.

• Fight against exclusion the NAC mac

  Experts, assuming that few users are now authenticate & viz cisco NAC network access, they be filtered from the NAC to exclude the posture of NAC will be they be disconnected from the network & reconnected since they were connected & now are going to be ignorant of the NAC.

  How it works in this case. users will be disconnected for that to be effective, or will they be disconnected by force before it takes effect.

  Thanks to you all.

  Hello

  There is a port bouncing feature Cisco NAC that accomplishes this task for you. But it depends on your deployment mode, it is not required for each of them. Please see this link:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/48/cam/m_oob.html

  Please indicate if you will find the entrance helpul. Thank you

  Farrukh

• Activation of the NAC HA puts several hosts and ASA with processor clocked at 100%

  I installed a NAC Manager and a NAC server in OOB without any problems, but when I configured the AP (high availability) with another server, my ASA and several guests in my network started work ant 100% of the cpu.

  I tried to configure each interface of the NAC on a single DMZ and the problem stops there.

  -That someone had this problem (NAC version 4.7)

  TKX

  Miguel Amaral

  Hello Miguel.

  When I started a NAC InBand HA solution I had a similar problem that I solved the heart rate HA configuration to use ETH0 just instead use ETH0 and ETH1.

  Best regards

  Luciano Carvalho

• Certificate of the NAC

  the certificate used to authenticate the NAC manager and server NAC I knew to the third I want to use the Microsoft certificate authority to create this certificate. Is cisco certified Microsoft CA if it is not what is the cisco certified list

  Wael,

  MS CA work perfectly well with the CCA.

  HTH,

  Faisal

• Problem of the NAC in the virtual tape gateway VPN SSO

  Hello

  I've implemented a NAC solution for remote users. The unit of CASE mode configured in the gateway enVirtual Strip.

  I followed all the steps listed in http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a008074d641.shtml

  Remote users can connect succeffuly using the cisco vpn software and they can ping the SIN, but not the DNS (the ASA offers IP @ but not the DNS I do not know why).

  When I access the NAS, I can download the NAC Agent but VPN SSO is not executed and the Agent asks me to connect using LOCAL DB.

  Any help please,.

  Kind regards

  Larson,

  For VPN SSO work, you must send the accounting package to the CAs. The CASE can in turn send for the ACS if you need accounting also be done on GBA, but for authentication ONLY work, the accountant must reach the CASE.

  HTH,

  Faisal

• The CAA of the NAC provider

  Hi all

  I am building the laboratory of the NAC. first of all, I have donwloaded CAA without external authentication server and used only localDB. everything worked well. then I added the server external authentication (LDAP AD). test auth, it works fine. but when CAA appears to connect, it does not show external server and shows that localDB. I reinstalled CAA, but it does not yet show external server.

  any ideas would be much appreciated.

  Thank you

  Alex

  If you have added AD SSO, which will not be displayed in the list of authentication providers. If you have added an LDAP provider, which should appear after you activate it. To make sure that you enable, see the definition of your user pages and check the providers you want to activate.

  HTH,

  Faisal

• Need of a rule on the NAC to deny access to the XP machines

  We run NAC 4.9.1 and I'm trying to think of a way to refuse any client Windows XP to get full network access. I created a new cheque which examines the registry key under:

  HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProductName

  For any string that contains "Windows XP." I have it on Audit right now and I see in the newspapers that the XP mahcines hit this requirement.

  Now, how can I deny that check?

  Hello

  The NAC itself has rules of compliance different OS that you want to allow on your network.

  Simply create a compliance rule indicating that you only allow windows 7. It works much better than the condition of the registry.

  I used to support this product back to Cisco, but unfortunately I don't have access to a NAC server so I don't know where exactly is this option.

  If you need more help feel free to ask and I'll be happy to help you.

  Kind regards

  Erdelgad

• The ACL of the NAC GuestUser

  I installation of the NAC for role based on the user assignment of VLAN deployed as OOB VG L2. I have a default access, authentication and configuration of VLAN user. The user VLANis for comments. Thus, a guest opens it broswer and the customer is prompted to enter credentials. Credentials are accepted. The browser refreshes IP and I get a "... limited connectivity. 169.254.etc... ». I get this error when I apply ACL below the interface ' user vlan "(i.e. ip access-group 110 in), when the ACL is not assign everything works fine and the comments can roam my entire internal network. My DHCP/DNS is on the 10.0.0.0 network. Anyone have any ideas why I get this error?

  access-list 110 deny ip 192.168.41.0 0.0.0.255 10.0.0.0 0.255.255.255

  access-list 110 deny ip 192.168.41.0 0.0.0.255 172.16.0.0 0.15.255.255

  access-list 110 permit ip 192.168.41.0 0.0.0.255 192.168.41.0 0.0.0.255

  access-list 110 deny ip 192.168.41.0 0.0.0.255 192.168.0.0 0.0.255.255

  access-list 110 permit ip 192.168.41.0 0.0.0.255 any

  Hi there-

  What Vlan and the property is intellectual property the guest user when he experiences the web page contestant powers?

  What vlan and IP do you want comments to have once the client authenticates as a guest?

  My first thought is that your ACL denies requests DHCP and DNS request, since you mention the DHCP and DNS are on the 10.0.0.0/8 network.

  thxs

  Peter

• Problem of the NAC - Agent is a disconnect

  Hello

  We have a problem with the NAC in mode virtual outofband.

  AD SSO, sanitation, everything is working, but the strange things happening: after awhile, when downloading large files, Agent connects to the formula of network users, and the registration process is restarted.

  I disabled the pulsation clocks and timers, session, but we still have a problem.

  Also, while sniffing traffic on the switch port, I noticed that after have correctly connected you to the own Cisco Agent network always send traffic to UDP Port 8905. Is this a normal behavior?

  I noticed problems with this version of the agent causing connections to give up intermittently. I would upgrade to agent v4.1.3.1.

• Problem of the NAC plugins & Nessus

  Hi all!

  I have a problem with the installation of the Nessus plugin. ((

  After reading Installation Guides I have not a clear understanding what files should I download. So I have 2 files:

  Nessus-plugins - 2.2.10.tar.gz (6507 KB)

  Nessus-plugins-GPL - 2.2.10.tar.gz (1071 KB)

  of http://www.nessus.org/download/index.php

  After renaming, I tried to download each of them turning the cam under updates of the Plugin. CAM said "Upload successful" and has always some plugins (Scan Setup-> Plugins).

  So I don't understand what the problem... ((

  Can someone share file plugins.tar.gz correct, please...?

  Concerning

  You must download and install the Nessus appropriate for your PC.

  After downloading the latest plugins on the site of Nessus, in the directory (for a Windows installation) c:/Program Files / sustainable / Nessus / Plugins, you will have a file 'plugin.tar.gz '. You can rename or copy this into "plugins.tar.gz".

  Then in the console the NAC Manager, under ACCESS OWN-> NETWORK SCANNER-> Plugin updates, go to the same folder and choose the file "plugins.tar.gz". It MUST be named exactly as described - with the S - to work. Complete the DOWNLOAD. When finished go to the Configuration of Scan tab and select all in the show _ Plugins dropdown. You should hae about 20,000 of them.

  HTH.

  Jim