Starting with Cisco NAC Appliance (NACA) release 4.1.2 a new Network Module (NM) hardware platform has been released. You can finally run the Cisco NAC Appliance Server on a Network Module platform that fits into the Cisco ISR router series (2800, 3800). The NACA NM can support up to 100 simultaneous users, perfect for smaller remote and branch offices. It comes in two sizes, a 50 user or a 100 user model. The 50 user is upgradeable to the 100 user via a software license key. The Nicest thing about this new NACA platform is it supports all of the same features of the full blown appliances. Well except one, failover is not supported at this time. But given it’s placement in the router NM slot, and its support for fail-open if it looses a connection back to the central manager, lack of this feature is probably just a red herring for most deployments. The NACA NM has two interfaces just like it’s appliance brothers, an eth0 (the trusted side interface) and eth1 (the untrusted side interface). The eth1 interface can be either a physical interface or connected virtually to a NME-ESW switch module. However the eth0 interface is always a virtual interface. It connects to the backplane of the ISR router and is given the IOS name interface Integrated-Service-Engine1/0. To access the NACA NM’s cli interface you go through the host router via a session like this; service-module integrated-service-engine slot/0 session
. This opens up a terminal session to the NACA NM CLI. The traffic flow with the new module in the network will vary based on the deployment method you use. Let’s take a rough look at the traffic flow if you use the Out-of-Band deployment method.
- LAN switch connects to untrusted interface of NACA NM but only carries authentication VLAN traffic
- New Host comes up on switch port. Switch notifies NACA of new host on network.
- NACA instructs switch to change the host’s port to the authentication VLAN so it can authenticate and posture assess the client.
- NACA NM intercepts all client traffic, performs Active Directory Single-sign-on authentication, and posture assesses the client.
- If the client is found to be out of policy then NACA moves the client into quarantine and provides the end-user with various remediation options. While in quarantine the network access provided to the client is severely limited.
- Once the client meets all of the security requirements, NACA instructs the switch to move the hosts port into the proper VLAN. This proper VLAN, called the access VLAN, can be determined by the users AD group membership info or some other AD attribute among other things.
- Once a host is on its assigned access VLAN, NACA is no longer in the traffic flow. All traffic will then go straight to the ISR router interface and not through the NACA NM anymore.
Pretty slick don’t you think? If you have any questions for me on how the NACA NM works just ask. For more info on the NAC Appliance NM see here http://www.cisco.com/univercd/cc/td/doc/product/vpn/ciscosec/cca/cca412/nacnm.htm . The opinions and information presented here are my personal views not those of my employeer.
