Cisco NAC Appliance hits on basic enforcement, but lags in advanced features

Clear Choice Tests  By Mandy Andress, Network World, 07/30/07

 Start a discussion    Print article

 Comments (1)    Print article

Cisco Systems

Score: 3.03

Cost: Pricing starts at $18,000 for Clean Access Server and Clean Access Manager.

Cisco’s NAC Appliance 4.1 (formerly called Cisco Clean Access) provides basic network-access-control functionality, such as antivirus and patch-status checks, but remains behind many of the other vendors in this space because of the inability to perform assessment checks beyond initial connection.

We reviewed CCA 3.4 in 2005 and beyond increased coverage for the antivirus market and new support for Windows Update services, we can’t point to any significant enhancements in the endpoint assessment or reporting areas between the two versions. Cisco’s biggest changes occurred in the authorization/authentication arena with the addition of single sign-on with Active Directory and integration with its Cisco VPN Concentrator product. From an enforcement perspective, Cisco now includes the ability to launch a remediation program if an endpoint fails its integrity check. None of these additions are particularly innovative, but rather are features that exist across the set of products tested.

The product has two main components and agent software. The Clean Access Manager provides centralized management features, while the Clean Access Server (CAS) provides the distributed enforcement capabilities. You can have multiple CASs deployed across your network, all managed through the single platform, which is a fairly typical scalability standard across the field of NAC products tested.

For testing, we placed the appliance running CAS in-line between the access and distribution layers of the network, which is typical of the in-line products tested.

Many other LAN-deployment options are available, such as placing it in an 802.1X-based network (see how that works in the NAC architecture test) or running it out-of-band, where it controls an access switch. Cisco NAC Appliance can also tap into Cisco’s VPN Concentrator to provide posture assessments and enforcement for remote-access users, which provides single sign-on for users. We verified this integration with IPSec only. Cisco also claims SSL VPN integration.

IT Tools & How To's, Just Posted

Backup and Disaster Recovery

Is your Data Center Ready for Virtualization?

Is your Data Center Running out of Power or Cooling?

The Vector Approach to Data Center Power Planning

The necessary convergence of IT and Facilities

Most Popular IT Tools & How To's

Getting to Know You: Managing Identity and Network Security

Governance and Risk Management: The New Security Reality

Optimizing IT Budgets In tight Economic Times

IT Management is Broken: It's Time to Stop the Silo Madness

Load Balancers Are Dead: Time to Focus on Application Delivery

About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW

Copyright, 1994-2008 Network World, Inc. All rights reserved.