Question commissioning of the ISE NAC agent

Similar Questions

• The popup NAC agent

  Dear,

  I have two devices ISE installed in a distributed deployment ("ISE1' primary and secondary"ISE2"), each node has three personas installed on it. The servers are recorded together and replication is working properly between nodes.

  When we work on the first node, all right, if I try to unplug it from ISE1 and do my tests on ISE2, the cisco NAC agent don't popup, unless I have to uninstall and reinstall again the ISE2. Then it will not work properly.

  Note: the version of the agent of the NAC is the following: nacagent - 4.9.0.37.

  Any idea?

  Concerning

  Zahi

  I don't have access to an ISE at the moment to find, but try this:

  Policy > policy elements > results > customer Provisioning > resources

  Edit profile, and there should be a box of discovery host.

  My apologies, I guess a little without access to the box, but it is certainly configurable, you don't have to add it manually.

• NAC agent does not parameter of customization of the CAM download

  Hello

  I would use the option of additional NAC 4.8.0 Agnet.

  Based on the 'Clean Access Manager Configuration Guide' is the branding.tar.gz of neccesery containing the custom nac_logo.gif, the nac_login.xml, the nac_Srings_xx.xml (in our case here in Hungary: nac_Srings_HU.xml). The package updet the cam has been successful.

  However, Agents do not update themselves.

  Other related settings on cam:

  Option: "the current NAC Agent is a mandatory upgrade" is checked in.

  I tried to put the files customized to the customer appropriate on a machine mannualy folder. After the next startup of the Agent, the changes are busy.

  What could be the couse that customers don't refresh themeself automatically by the CAM/CAS.

  Thank you very much

  Csaba

  Hi Csaba,

  I confirm that the document is false, so that personalization information are only after a (re) installation of the Agent.

  Allow me to connect to a documentation bug to fix this...

  Thank you for this comment.

  Kind regards

  Federico

• Cisco's NAC agent does not

  Hey guys! My school uses the Cisco NAC Agent for security on our network, but it gives me problems at the moment. My Windows is fully updated, a mandatory requirement. However, I have done some Windows updates automatically for a while now, and I spent the last few hours manually, download, installation, System Restore to a date in the past and then redownloading, etc..

  I'm in my third year on that campus, and I always had minor problems, which none has caused me a problem until now. I'm not sure what the underlying problem is, and I don't know if this is a common problem for this stage, but I was hoping that I could receive aid better here that guys in the student technology services desk. I am working from my laptop on campus wireless, but this isn't helping me get my Office Online

  I have attached the newspaper report of Cisco of the packer.

  Hello

  We can see the agent to tell you:

  "Your computer is missing one or more critical updates. Run Windows Update and check that you have all critical patches installed. »

  And it's true that Agent to do some checks which is a failure.

  Now these controls check some registry keys related to Internet Explorer and a few other internal items.

  Unfortunately, it is that your network administrator which should help you to solve this problem, because the application of the NAC Manager will have a detailed report of what exactly a failure in your machine and then the requirements are changed to allow you to access or your machine must comply with the requirements.

  HTH,
  Tiago

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• ISE - profile of the NAC agent

  Dears

  I want to deploy via GPO NAC agent and I need to create the agent profile, I know how to create on ISE, but how to get the file in xml format which will be distributed?

  You can try to install only a single PC (whether by a manual installation or captive portal). If you have set up rules of posture while ISE then the NAC Agent automatically contacts the ISE server and downloads the last NACAgentcfg.xml.

  Then you can browse the following directory and find the NACAgentcfg.xml file in your PC.

  C:\Program Files (x 86) \Cisco\Cisco NAC Agent

  After that, you can deploy mass agent of the NAC as well as the xml file. Well that is not required to deploy the xml file as a I said, every time, there is a rule of posture the NAC agent will download the last available the ISE Server NACAgentcfg.xml.

  Please rate if this can help.

• The NAC Agent autoUpgrade ISE possible?

  Hi all

  I have this:

  802.1 x-window with the NacAgent version (say 1) <---->802. 1 x switch active (RADIUS aaa OK) <------>ISE and AD on the same LAN

  ISE is configured for client provisioning with hardware (NacAgent version 2) downloaded from Cisco's Web site (as described in the documentation)

  I have a basic plan of authentication and authorization that allow me to well but I expect the NACAgent to be upgraded.

  No profiling is configured at the moment.

  Is that someone can help?

  Best regards?

  Hello

  In the ISE settings provisioning client, activate you the option where the NAC upgrade agent is required. However, it is to you to run updates perioidic and map the most recent agent in the configuration of the parameters of the client.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• ISE 1.1.3 problem commissioning of the first connection to DOT1x

  Hi all

  I wonder how a wired client dot1x can get downloaded NAC its first connection to the ISE agent?

  The Agent must be installed before the first connection?

  I'have configure ISE 1.1.3 for the supply (files have been downloaded from the website of cisco) (mandatory update)

  I have an AuthZ rule for an evaluation of the correct posture

  and

  another rule AuthZ for assessment of unknown posture that triggers a rehabilitation of posture (download file)

  (in that order)

  NAC agent is properly configured (FQDN...), gets users and nothing happen!

  No upgrades NAC

  no assessment of the NAC.

  Any idea?

  It takes a while for the new agent to download?

  Best regards.

  C.

  To address the problem of the NAC agent, we need to check things.like couples

  1.) sure that the host address discovery on Mac OS X or Cisco NAC agent pointing the domain FULL of Cisco ISE name. (Right-click on the icon of the NAC agent,

  Click Properties and check the host of discovery).

  (2.) to ensure that the access switch allows communication between Cisco ISE Switzerland and the client machine end. limited access ACL applied for the session should allow the Swiss ports:

  permit tcp any host 80.0.80.2 eq 8905--> is for posture

  communication between the NAC and ISE (ports of Swiss) officer

  allow udp any host 80.0.80.2 eq 8905--> is for posture

  communication between the NAC and ISE (ports of Swiss) officer

  refuse an entire ip

  (3.) if the connection agent dialog box still does not appear, it could be a certificate problem. Make sure that the certificate that is used for communication Switzerland on the final customer is in the ISE Cisco certificate trust list.

  4.) make sure that the default gateway is accessible from the client machine.

  According to the guidelines of your confirmation, I close the case for this specific survey. We strive to provide you with excellent service. Please do not hesitate to reach out the hand to me or any member of the team of BAG if we can be of further assistance or if you have other questions related to the future. We appreciate your comments and look forward to serve you to make progress.

• The NAC Agent running application scan

  Ladies and gentlemen,

  My client is to be on ISE PoC. They want to test the functionality of Posture to run the application.

  I would like to ask: what is the NAC agent scan interval. If I want to use Agent NAC to scan the PC, an illegal demand, but initially, during the connection, the application is not running. After NAC agent notify that it respects the customer, user start this application. The question therefore, Agent NAC detectable by whom?

  Kindly share your experience about it. Thank you for your support.

  Kind regards

  Hiep

  Hiep,

  The feature you requested is passive revaluation and is made on intervals configured by the administrator.

  www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_pos_pol.html#...

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• 1.3 of the ISE and NAC

  I have a client that 5508 WLCs runs through the area, and I'm catching IEEE802.1x authentication for the enterprise WLAN and WebAuth for WLAN of comments... they PSK now :(

  They have ad and ISE and NAC great interest, so my immediate thoughts are to integrate ISE AD and use ISE as RADIUS server for .1x on the WLC. Then use the WLC and ISE do WebAuth for comments... It's all of the standard stuff, but it gives the background.

  Now, we come to the interesting bit... they want to run BYOD. They are involved in the financial markets, so the BYOD must be tightly controlled. They ask on ISE coupled with the NAC, but I am not convinced that I need the NAC since the arrival of the ISE1.3. Of course, I will examine three (min) SSID, corporate knowledge, comments and BYOD, just logically distinct. I have nothing that ISE 1.2 cannot press the company and comments but BYOD must full profiling and reclamation prohibition or device before access to the net.

  Someone at - he comments or suggestions? Is ISE 1.3 enough NAC-like that I don't need more, or if this is not the case, what additional benefits does that ISE can support

  Thanks for your advice/comments/experiences

  Jim

  Hi Jim -.

  Version 1.3 offers an integrated PKI and a significantly improved services reviews experience. The internal PKI is nice if the customer does not have a PKI solution in place. Don't forget however that the PKI ISE internal can only issue certificates to BYOD devices which have boarded through the ISE BYOD "flow", you cannot use the ISE PKI to issue certificates to computers in the domain.

  With regard to the NAC: you need to specify exactly what is needed here. If you were to make "posture assessment" then ISE can do for machines based on Windows and OSX. You can check for things like: A / V, a/s, status of the firewall, Windows hotfixes. If you want to make the posture on mobile devices, so you will need to integrate ISE with MDM (mobile device management) solution such as: Airwatch, Mobile, Extend360 iron, etc. ISE may question the MDM for things like: the device is protected with a PIN, is the rooted device, is the encrypted device, etc.

  I hope this helps!

  Thank you for evaluating useful messages!

• Agent of Cisco ISE - NAC is not downloading

  Hi all

  Download NAC agent does not occur for customers. It redirects to this Web page, but shows error as "the administrator has disabled the download feature. What could be the problem?

  The error message is displayed on the page of ISE or just a generic Windows error?

• Connection disabled for the Nac Agent

  Hello

  After installing the NAC Agent on Windows XP.

  The login window does not appear.

  Please see the attached support cisco report.

  Please suggest to overcome this problem.

  Thank you

  Abuzar

  Well, the default gw is an L3 device you have on your network, and if there is a firewall you will need to open the communication to these ports.

  What is the configuration of VLANS on the switch where the client is connected?

  Do you have an organizational chart?

  See you soon,.

  Tiago

• Problem of the NAC - Agent is a disconnect

  Hello

  We have a problem with the NAC in mode virtual outofband.

  AD SSO, sanitation, everything is working, but the strange things happening: after awhile, when downloading large files, Agent connects to the formula of network users, and the registration process is restarted.

  I disabled the pulsation clocks and timers, session, but we still have a problem.

  Also, while sniffing traffic on the switch port, I noticed that after have correctly connected you to the own Cisco Agent network always send traffic to UDP Port 8905. Is this a normal behavior?

  I noticed problems with this version of the agent causing connections to give up intermittently. I would upgrade to agent v4.1.3.1.

• NAC agent the wireless runs whenever we have controllers

  Hello everyone, we have a problem in our environment and wanted to inquire about this. We have a Cisco wireless infrastructure in place - 5508 2 controllers and about 200 3502 AP we have split the AP evenly between 2 controllers. We backend system with an own server in the strip of the NAC device for post assesment. What we are seeing, is that when a user "passes" a point of access to the other, and if the AP is connected to 2 separate controllers, the NAC agent will take place once again. Newspapers in cam supports this, as we see the user is disconnected and then reconnected. We have 2 controllers configured in a mobility group which should allow roaming. So what would be the expected behavior? Is the controller always send RADIUS Accounting Stop packets to the CAs when it tends a session wireless to another controller, even if they are in a group of mobility?  Any help or thoughts would be appreciated.

  Thank you

  The f

  Jeff,

  Since you're using dot1x, I found the following note in the configuration guide for mobility:

  http://www.Cisco.com/en/us/docs/wireless/controller/7.2/configuration/guide/cg_mobility.html

  

  All clients configured with 802. full authentication is complete by 1 security X/Wi-Fi Protected Access (WPA) to conform to the IEEE standard.

  Your radius server that you see a second authentication attempt from the second controller? If Yes, then most likely, this is because of the management of accounts radius stop and start messages while roaming.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• NAC agent and configuration of NHPS with ISE 1.1.1

  I try to get all the workstations (OSX and Windows) install the begging native NAC Agent and Assistant during the on-board process.

  I currently use portal default comments to EHT.

  The environment has been implemented using a design of dual SSID.

  For the moment, devices can plug the SSID of provisioning and get the CWA. Recording device works, the portal is running the installer of NHPS that correctly implements the network card.

  The problem is that the portal never tries to install the NAC Agent.

  Has a political client provisioning policies for wired and wireless as well as BONES. Each strategy includes a PSN and Agent NAC configuration. It seems that portal comments only checks the configuration of PSN and not the NAC Agent config.

  Any ideas?

  Just if I understand correctly, you are using both a client provisioning portal and a native Portal begging provisoning related policies separate authz.

  With that road you check to see if the customer is consistent in the political portal provisioning client.

  Let me know if you have following configured (windows OS in the example), this implies that endpoint is statically assigned to RegisteredDevices after native pursueth provisioning.

  Rule 0 (Group of endpoint = RegisteredDevice) AND (AD:Domain user and authentication method: x 509 and posturestatus: COMPATIBLE) = access allowed

  Rule 1 (Group of endpoint = RegisteredDevice) AND (AD:domain user authentication method: x 509 [If you have deployed the certs to the State native supp] AND workstation NOT EQUAL: COMPLIANT) client provisioning RESULT portal.

  Rule 2 (endpoint = Workstation group) AND RESULTS (AD:Domain user AND breed authentication using mschapv2) provisioning windows portal

  Hope that helps,

  Tarik Admani
  * Please note the useful messages *.

• NAC agent constantly authenticate

  I have a problem with NAC 4.9.4.3 where he réauthentifie randomly. There is no newspaper on the switch or within ISE to explain why this happens. The user seems to remain connected. Did somebody encounter this problem?

  Hi Deirra,

  How many times do you see that? You experience this problem with all the endpoints?

  If you don't see the newspaper on the ISE/switch so maybe not pure new authentication. The question may be followed by looking at the NAC agent logs.

  -Jousset