Cisco Network Admission Control, Volume II: Deployment and Troubleshooting

Overview

Cisco Network Admission Control

Volume II: NAC Framework Deployment and Troubleshooting

The self-defending network in action

Jazib Frahim, CCIE® No. 5459

Omar Santos

David White, Jr., CCIE No. 12,021

When most information security professionals think about threats to their networks, they think about the ...

See more details below
Paperback (New Edition)
$53.18
BN.com price
(Save 18%)$65.00 List Price
Other sellers (Paperback)
  • All (8) from $6.52   
  • New (5) from $46.50   
  • Used (3) from $6.52   
Sending request ...

Overview

Cisco Network Admission Control

Volume II: NAC Framework Deployment and Troubleshooting

The self-defending network in action

Jazib Frahim, CCIE® No. 5459

Omar Santos

David White, Jr., CCIE No. 12,021

When most information security professionals think about threats to their networks, they think about the threat of attackers from the outside. However, in recent years the number of computer security incidents occurring from trusted users within a company has equaled those occurring from external threats. The difference is, external threats are fairly well understood and almost all companies utilize tools and technology to protect against those threats. In contrast, the threats from internal trusted employees or partners are often overlooked and much more difficult to protect against.

Network Admission Control (NAC) is designed to prohibit or restrict access to the secured internal network from devices with a diminished security posture until they are patched or updated to meet the minimum corporate security requirements. A fundamental component of the Cisco® Self-Defending Network Initiative, NAC enables you to enforce host patch policies and to regulate network access permissions for noncompliant, vulnerable systems.

Cisco Network Admission Control, Volume II, helps you understand how to deploy the NAC Framework solution and ultimately build a self-defending network. The book focuses on the key components that make up the NAC Framework, showing how you can successfully deploy and troubleshoot each component and the overall solution. Emphasis is placed on real-world deployment scenarios, and the book walks you step by step through individual component configurations. Along the way, the authors call out best practices and tell you which mistakes to avoid. Component-level and solution-level troubleshooting techniques are also presented. Three full-deployment scenarios walk you through application of NAC in a small business, medium-sized organization, and large enterprise.

“To successfully deploy and troubleshoot the Cisco NAC solution requires thoughtful builds and design of NAC in branch, campus, and enterprise topologies. It requires a practical and methodical view towards building layered security and management with troubleshooting, auditing, and monitoring capabilities.”

–Jayshree V. Ullal, Senior Vice President, Datacenter, Switching and Security Technology Group, Cisco Systems®

Jazib Frahim, CCIE® No. 5459, is a senior network security engineer in the Worldwide Security Services Practice of the Cisco Advanced Services for Network Security team. He is responsible for guiding customers in the design and implementation of their networks with a focus on network security.

Omar Santos is a senior network security engineer in the Worldwide Security Services Practice of the Cisco Advanced Services for Network Security team. He has more than 12 years of experience in secure data communications.

David White, Jr., CCIE No. 12,021, has more than 10 years of networking experience with a focus on network security. He is currently an escalation engineer in the Cisco TAC, where he has been for more than six years.

  • Effectively deploy the Cisco Trust Agent
  • Configure Layer 2 IP and Layer 2 802.1x NAC on network access devices
  • Examine packet flow in a Cisco IOS NAD when NAC is enabled, and configure Layer 3 NAC on the NAD
  • Monitor remote access VPN tunnels
  • Configure and troubleshoot NAC on the Cisco ASA and PIX security appliances
  • Install and configure Cisco Secure Access Control Server (ACS) for NAC
  • Install the Cisco Security Agent Manage-ment Center and create agent kits
  • Add antivirus policy servers to ACS for external antivirus posture validation
  • Understand and apply audit servers to your NAC solution
  • Use remediation servers to automatically patch end hosts to bring them in compliance with your network policies
  • Monitor the NAC solution using the Cisco Security Monitoring, Analysis, and Response System (MARS)

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Category: Cisco Press–Security

Covers: Network Admission Control

Read More Show Less

Product Details

  • ISBN-13: 9781587052255
  • Publisher: Cisco Press
  • Publication date: 12/5/2006
  • Series: Networking Technology Series
  • Edition description: New Edition
  • Pages: 624
  • Product dimensions: 7.40 (w) x 9.00 (h) x 1.40 (d)

Meet the Author

Jazib Frahim, CCIE No. 5459, has been with Cisco Systems for more than seven years. With a Bachelor’s degree in computer engineering from Illinois Institute of Technology, he started out as a TAC engineer with the LAN Switching team. He then moved to the TAC Security team, where he acted as a technical leader for the security products. He led a team of 20 engineers as a team leader in resolving complicated security and VPN technologies. Jazib is currently working as a Senior Network Security Engineer in the Worldwide Security Services Practice of Cisco’s Advanced Services for Network Security. He is responsible for guiding customers in the design and implementation of their networks, with a focus in network security. He holds two CCIEs, one in Routing and Switching and the other in Security. He also authored the Cisco Press book Cisco ASA: All-in-one Firewall, IPS, and VPN Adaptive Security Appliance(ISBN: 1-58705-209-1). Additionally, Jazib has written numerous Cisco online technical documents and has been an active member on Cisco’s online forum, NetPro. He has presented at Networkers on multiple occasions and has taught many onsite and online courses to Cisco customers, partners, and employees.

Jazib is currently pursuing a Master of Business Administration (MBA) degree from North Carolina State University.

Omar Santos is a Senior Network Security Consulting Engineer in the Worldwide Security Services Practice of Cisco’s Advanced Services for Network Security. He has more than 12 years of experience in secure data communications. Omar has designed, implemented, and supported numerous secure networks for Fortune 500 companies and the U.S. government, including the United States Marine Corps (USMC) and Department of Defense (DoD). He is also the author of the Cisco Press book Cisco ASA: All-in-one Firewall, IPS, and VPN Adaptive Security Appliance(ISBN: 1-58705-209-1) and many Cisco online technical documents and configuration guidelines. Prior to his current role, he was a technical leader of Cisco’s Technical Assistance Center (TAC), where he taught, led, and mentored many engineers within the organization. He is an active member of the InfraGard organization, a cooperative undertaking between the Federal Bureau of Investigation and an association of businesses, academic institutions, state and local law-enforcement agencies, and other participants that are dedicated to increasing the security of the critical infrastructures of the United States of America. Omar has also delivered numerous technical presentations to Cisco customers, partners, and other organizations.

David White, Jr., CCIE No. 12021, has more than ten years of networking experience with a focus on network security. He is currently an Escalation Engineer in the Cisco TAC, where he has been for more than six years. In his role at Cisco, he is involved in new product design and implementation and is an active participant in Cisco documentation, both online and in print. David holds a CCIE in Security and is also NSA IAM certified. Before joining Cisco, David worked for the U.S. government, where he helped secure its worldwide communications network. He was born and raised in St. Petersburg, Florida, and received his Bachelor’s degree in computer engineering from the Georgia Institute of Technology.

Read More Show Less

Table of Contents

Introduction

Part I NAC Overview

Chapter 1 NAC Solution and Technology Overview

Network Admission Control

NAC: Phase I

NAC: Phase II

NAC Program Participants

Components That Make Up the NAC Framework Solution

Cisco Trust Agent

Cisco Security Agent

Network-Access Devices

Cisco VPN 3000 Series Concentrator

Cisco Secure Access Control Server

Event Monitoring, Analysis, and Reporting

Summary

Review Questions

Part II Configuration Guidelines

Chapter 2 Cisco Trust Agent

Preparing for Deployment of CTA

Supported Operating Systems

Deploying CTA in a Lab Environment

CTA Windows Installation

CTA Windows Installation with the 802.1X Wired Supplicant

CTA Mac Installation

CTA Linux Installation

Installing the CA Certificate

User Notifications

Customizing CTA with the Optional ctad.ini File

[main] Section

[EAPoUDP] Section

[UserNotifies] Section

[ServerCertDNVerification] Distinguished Name-Matching Section

[Scripting_Interface] Section

Example ctad.ini

CTA Scripting Interface

Requirements for Using the Scripting Interface

Executing the Scripting Interface

CTA Logging Service

Creating a ctalogd.ini File

Using the clogcli Utility

Deploying CTA in a Production Network

Deploying CTA on Windows

Deploying CTA on Mac OS X

Deploying CTA on Linux

Troubleshooting CTA

Installation Issues

Communication Issues

System Logs

CTA Client Fails to Receive a Posture Token

CTA 802.1X Wired Client

Client Is Disconnected (Suspended)

Chapter Summary

References

Review Question

Chapter 3 Cisco Secure Services Client

Installing and Configuring the Cisco Secure Services Client

Minimum System Requirements

Installing the Cisco Secure Services Administrative Client

Configuring the Cisco Secure Services Administrative Client

Deploying the Cisco Secure Services Client in a Production Network

End-User Client Deployment Installation Prerequisite

Creating End-User Client-Configuration Files

Creating the License File

Deploying the End-User Client

Viewing the Current Status of the Cisco Secure Services Client

Windows Wireless Zero Configuration

Troubleshooting the Cisco Secure Services Client

System Report Utility

Viewing the Client Logs and Connection Status in Real Time

Client Icon Does Not Appear in System Tray

Client GUI Does Not Start

Client Does Not Prompt for Password

Wireless Client Is Immediately Dissociated after 802.1X Authentication

Client Is Disconnected (Suspended)

Summary

References

Review Question

Chapter 4 Configuring Layer 2 NAC on Network Access Devices

NAC-L2-IP

Architecture of NAC-L2-IP

Configuring NAC-L2-IP

Troubleshooting NAC-L2-IP

NAC-L2-802.1X

Architecture of NAC-L2-802.1X

Configuring NAC-L2-802.1X

MAC Authentication Bypass

Troubleshooting NAC-L2-802.1X

Configuring NAC-L2-802.1X on Cisco Wireless Access Points

Summary

Review Questions

Chapter 5 Configuring Layer 3 NAC on Network Access Devices

Architectural Overview of NAC on Layer 3 Devices

Configuration Steps of NAC on Layer 3 Devices

Step 1: Configuring AAA Authentication

Step 2: Defining the RADIUS Server

Step 3: Specifying the Interface Access Control List

Step 4: Configuring the NAC Parameters

Step 5: Defining the NAC Intercept Access Control List (Optional)

Step 6: Setting Up the Exception Policies (Optional)

Step 7: Configuring the Clientless Host Parameters (Optional)

Step 8: Optimizing the NAC Parameters (Optional)

Monitoring and Troubleshooting NAC on Layer 3 Devices

Useful Monitoring Commands

Troubleshooting NAC

Summary

Review Questions

Chapter 6 Configuring NAC on Cisco VPN 3000 Series Concentrators

Architectural Overview of NAC on Cisco VPN 3000 Concentrators

Cisco Software Clients

Microsoft L2TP over IPSec Clients

Configuration Steps of NAC on Cisco VPN 3000 Concentrators

VPN Configuration on the VPN 3000 Concentrator

VPN Configuration on the Cisco VPN Client

NAC Configuration on the VPN 3000 Concentrator

Testing, Monitoring, and Troubleshooting NAC on Cisco VPN 3000 Concentrators

Remote-Access IPSec Tunnel Without NAC

Remote-Access IPSec Tunnel from an Agentless Client

Remote-Access IPSec Tunnel from a CTA Client

Summary

Review Questions

Chapter 7 Configuring NAC on Cisco ASA and PIX Security Appliances

Architectural Overview of NAC on Cisco Security Appliances

Stateless Failover for NAC

Per-Group NAC Exception List

Configuration Steps of NAC on Cisco Security Appliances

VPN Configuration on the Security Appliances

VPN Configuration on the Cisco VPN Client

NAC Configuration on the Cisco Security Appliances

Testing, Monitoring, and Troubleshooting NAC on Cisco Security Appliances

Remote-Access IPSec Tunnel Without NAC

Remote-Access IPSec Tunnel from an Agentless Client

Remote-Access IPSec Tunnel from a CTA Client

Monitoring of NAC Sessions

Summary

Review Questions

Chapter 8 Cisco Secure Access Control Server

Installing ACS

Installation Prerequisites

Installing ACS on a Windows Server

Upgrading from Previous Versions of ACS Server

Post-Installation Tasks

Initial ACS Configuration

Configuring Network Device Groups (Optional)

Adding Network Access Devices

Configuring RADIUS Attributes and Advanced Options

Installing Certificates

Configuring Global Authentication Protocols

Creating Network Access Profiles Using NAC Templates

Posture Validation

Internal Posture-Validation Policies

External Posture Validation and Audit Servers

Miscellaneous Posture-Validation Options

Posture Enforcement

Downloadable IP ACLs

VLAN Assignment

Policy-Based ACLs

RADIUS Authorization Components

Network Access Profiles

Protocols Policy

Authentication Policy

Posture Validation Policy

Authorization Policy

Network Access Filtering

NAC Agentless Hosts

Centralized Agentless Host Policy for NAC-L3-IP and NAC-L2-IP

Centralized Agentless Host Policy for NAC-L2-802.1X (MAC Authentication Bypass)

Configuring the Agentless Host Policy on ACS

User Databases

Importing Vendor Attribute-Value Pairs

Enabling Logging

Configuring Failed Attempts Logging

Configuring Passed Authentications Logging

Configuring RADIUS Accounting Logging

Replication

Troubleshooting ACS

Enabling Service Debug Logging

Invalid Protocol Data

RADIUS Posture-Validation Requests Are Not Mapped to the Correct NAP

RADIUS Dictionaries Missing from the Interface Configuration Section

Certificate Issues—EAP-TLS or PEAP Authentication Failed During SSL Handshake in Failed Attempts Log

Summary

Review Questions

Chapter 9 Cisco Security Agent

Cisco Security Agent Architecture

CSA MC Rule Definitions

Global Event Correlation

Installing Cisco Security Agents Management Center

Configuring CSA NAC-Related Features

Creating Groups

Creating Agent Kits

System State and NAC Posture Changes

Summary

Review Questions

Chapter 10 Antivirus Software Integration

Supported Antivirus Software Vendors

Antivirus Software Posture Plug-Ins

Antivirus Policy Servers and the Host Credential Authorization Protocol (HCAP)

Adding External Antivirus Policy Servers in Cisco Secure ACS

Summary

Review Questions

Chapter 11 Audit Servers

Options for Handling Agentless Hosts

MAC Authentication Bypass

Audit Servers

Architectural Overview of NAC for Agentless Hosts

Configuring Audit Servers

Installation of QualysGuard Scanner Appliance

Configuration of QualysGuard Scanner Appliance

Configuration of CS-ACS Server

Monitoring of Agentless Hosts

Monitoring Agentless Hosts on QualysGuard Scanner

Monitoring CS-ACS Logs

Monitoring Agentless Hosts on a Cisco NAD

Summary

Review Questions

Chapter 12 Remediation

Altiris

Altiris Network Discovery

Importing Attribute Files to Cisco Secure ACS

Setting External Posture Validation Audit Server on Cisco Secure ACS

Installing the Altiris Network Access Agent and Posture Plug-In

Exception Policies

Creating Posture Policies on the Altiris Notification Server

PatchLink

Summary

Review Questions

Part III Deployment Scenarios

Chapter 13 Deploying and Troubleshooting NAC in Small Businesses

NAC Requirements for a Small Business

Small Business Network Topology

Configuring NAC in a Small Business

Cisco Secure ACS

End-User Clients

Switches

Web Server

Troubleshooting NAC Deployment in a Small Business

show Commands

EAP over UDP Logging

Cisco Secure ACS Logging

Certificate Issues: EAP-TLS or PEAP Authentication Failed During SSL Handshake

Incorrect Time or Date

Summary

Review Questions

Chapter 14 Deploying and Troubleshooting NAC in Medium-Size Enterprises

Deployment Overview of NAC in a Medium-Size Enterprise

The User Network

The Management Network

The Quarantine Network

Business Requirements for NAC in a Medium-Size Enterprise

Medium-Size Enterprise NAC Solution Highlights

Enforcement Actions

Steps for Configuring NAC in a Medium-Size Enterprise

Catalyst 6500 CatOS Configuration

VPN 3000 Concentrator Configuration

Audit Server Configuration

Altiris Quarantine Solution Configuration

Trend Micro Policy Server Configuration

Cisco Secure ACS Configuration

CSA-MC Server Configuration

End-User Clients

Monitoring and Troubleshooting NAC in a Medium-Size Enterprise

Diagnosing NAC on Catalyst 6500 Switch

Diagnosing NAC on a VPN 3000 Concentrator

Cisco Secure ACS Logging

Summary

Review Questions

Chapter 15 Deploying and Troubleshooting NAC in Large Enterprises

Business Requirements for Deploying NAC in a Large Enterprise

Security Policies

Enforcement Actions

Design and Network Topology for NAC in a Large Enterprise

Branch Office

Regional Office

Headquarters

Configuring NAC in a Large Enterprise

ACS

End-User Clients

Switches

Troubleshooting NAC Deployment in a Large Enterprise

show Commands

debug Commands

ACS Logs and CS-MARS

Summary

Review Questions

Part IV Managing and Monitoring NAC

Chapter 16 NAC Deployment and Management Best Practices

A Phased Approach to Deploying NAC Framework

Readiness Assessment

Stakeholders

Initial Lab Environment

Test Plans

Initial Tuning

Final Deployment Strategy

Provisioning of User Client Software

CSA Management

Maintaining NAC Policies

Keeping Operating System Policies Up-to-Date

Keeping Your Antivirus Policies Up-to-Date

Maintenance of Remediation Servers and Third-Party Software

Technical Support

Education and Awareness

End-User Education and Awareness

Help-Desk Staff Training

Engineering and Networking Staff Training

Summary

References

Review Questions

Chapter 17 Monitoring the NAC Solution Using the Cisco Security Monitoring, Analysis, and Response System

CS-MARS Overview

Setting Up Cisco IOS Routers to Report to CS-MARS

Defining the Cisco IOS Router as a Reporting Device within CS-MARS

Configuring the Cisco IOS Router to Forward Events to CS-MARS

Setting Up Cisco Switches to Report to CS-MARS

Defining the Cisco Switch as a Reporting Device within CS-MARS

Configuring the Cisco Switch to Forward Events to CS-MARS

Configuring ACS to Send Events to CS-MARS

Defining ACS as a Reporting Device within CS-MARS

Configuring Logging on ACS

Configuring 802.1X NADs in ACS to Report to CS-MARS

Installing the pnlog Agent on ACS

Configuring CSA to Send Events to CS-MARS

Defining CSA-MC as a Reporting Device within CS-MARS

Configuring CSA-MC to Forward Events to CS-MARS

Configuring VPN 3000 Concentrators to Send Events to CS-MARS

Defining the VPN 3000 Concentrator as a Reporting Device within CS-MARS

Configuring the VPN 3000 Concentrator to Forward Events to CS-MARS

Configuring the Adaptive Security Appliance and PIX Security Appliance to Send Events to CS-MARS

Defining the ASA/PIX Appliance as a Reporting Device within CS-MARS

Configuring the ASA/PIX Appliance to Forward Events to CS-MARS

Configuring QualysGuard to Send Events to CS-MARS

Generating Reports in CS-MARS

NAC Report—Top Tokens

NAC Report—Infected/Quarantine—Top Hosts

NAC Report—Agentless (Clientless) Hosts

Creating Scheduled NAC Reports

Troubleshooting CS-MARS

Events from a Specific Device Are Not Showing Up

Events Are Showing Up from an Unknown Reporting Device

Trouble Discovering a Monitored Device

Summary

Reference

Review Questions

Part V Appendix

Appendix A Answers to Review Questions

1587052253 TOC 11/2/2006

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star

(0)

4 Star

(0)

3 Star

(0)

2 Star

(0)

1 Star

(0)

Your Rating:

Your Name: Create a Pen Name or

Barnes & Noble.com Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & Noble.com that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & Noble.com does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at BN.com or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation

Reminder:

  • - By submitting a review, you grant to Barnes & Noble.com and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Noble.com Terms of Use.
  • - Barnes & Noble.com reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & Noble.com also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on BN.com. It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

 
Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)