Cisco NAC Appliance hits on basic enforcement, but lags in advanced features

Clear Choice Tests  By Mandy Andress, Network World, 07/30/07

 Start a discussion    Print article

 Comments (1)    Print article

Cisco Systems

Score: 3.03

Cost: Pricing starts at $18,000 for Clean Access Server and Clean Access Manager.

Cisco’s NAC Appliance 4.1 (formerly called Cisco Clean Access) provides basic network-access-control functionality, such as antivirus and patch-status checks, but remains behind many of the other vendors in this space because of the inability to perform assessment checks beyond initial connection.

We reviewed CCA 3.4 in 2005 and beyond increased coverage for the antivirus market and new support for Windows Update services, we can’t point to any significant enhancements in the endpoint assessment or reporting areas between the two versions. Cisco’s biggest changes occurred in the authorization/authentication arena with the addition of single sign-on with Active Directory and integration with its Cisco VPN Concentrator product. From an enforcement perspective, Cisco now includes the ability to launch a remediation program if an endpoint fails its integrity check. None of these additions are particularly innovative, but rather are features that exist across the set of products tested.

The product has two main components and agent software. The Clean Access Manager provides centralized management features, while the Clean Access Server (CAS) provides the distributed enforcement capabilities. You can have multiple CASs deployed across your network, all managed through the single platform, which is a fairly typical scalability standard across the field of NAC products tested.

For testing, we placed the appliance running CAS in-line between the access and distribution layers of the network, which is typical of the in-line products tested.

Many other LAN-deployment options are available, such as placing it in an 802.1X-based network (see how that works in the NAC architecture test) or running it out-of-band, where it controls an access switch. Cisco NAC Appliance can also tap into Cisco’s VPN Concentrator to provide posture assessments and enforcement for remote-access users, which provides single sign-on for users. We verified this integration with IPSec only. Cisco also claims SSL VPN integration.

IT Tools & How To's, Just Posted

Security convergence equals network security cost savings

IBM ISS X-Force Threat and Risk Report

Achieving Network Payment Card Industry Data Security Standard (PCI DSS) Compliance with Netcordia's NetMRI

Top 5 Network Performance Management Mistakes & How to Avoid Them

Guide to Open-Source Identity Management Software

Most Popular IT Tools & How To's

Getting to Know You: Managing Identity and Network Security

Load Balancers Are Dead: Time to Focus on Application Delivery

Trust But Verify: Managing and Auditing Privileged Users

Top 10 Threats to SME Data Security (and what to do about them)

Addressing Compliance Initiatives with Tripwire and the Center for Internet Security

About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW

Copyright, 1994-2008 Network World, Inc. All rights reserved.