Cisco Wireless NAC Appliance - Design Practices ??

Hi,
I have a new Cisco WIreless NAC appliance, the purpose of which is to manage the Guest users access to network. I have been searching for some best practices related to the design of this appliance but havent found one.
Can anybody help me in sharing his design experience or any docuement which would be guiding in deciding over the design / placement of this NAC device in network.
Thank You.

Hi,
there is nothing such as "Wireless Nac appliance".
The question is "do you have the NAC Guest Server" or the "Nac appliance Server and Nac appliance Manager (CAS/CAM)" ?
Because those are just not the same at all.
Then on the wireless side, do you have autonomous APs or a WLC ?
Sorry to ask, but there's just so many possibilities you could be asking that we need to clarify.
My bet is that you are either looking for this :
http://www.cisco.com/en/US/partner/products/ps6128/products_configuration_example09186a0080a138cc.shtml
or for this :
http://www.cisco.com/en/US/partner/docs/security/nac/guestserver/configuration_guide/20/g_hotspots.html#wp1092277
Nicolas
===
Don't forget to rate answers that you find useful

Similar Messages

  • Cisco Wireless Location Appliance

    dear
    i have WCS with 500 ap License
    i need to have Cisco Wireless Location Appliance what lisens i need for 500 ap
    please explain to me that

    Hi Ahmed,
    This is the upgrade License SKU for upgrading WCS to WCS Location;
    WCS-LOC-UPG-K9
    Supports deployment of Cisco WCS on a single server only.
    For customers upgrading from their existing Cisco WCS base licenses to equivalent Cisco WCS location licenses running Cisco WCS Software Release 4.1 or later.
    Available as Cisco WCS location in increments of 50, 100, or 500 lightweight access points.
    Customers currently using this license with Cisco WCS Software Release 4.0 are encouraged to upgrade to Cisco WCS Software Release 4.1, but they are not required to do so.
    Order the Correct Cisco WCS SKUs
    The process to order Cisco WCS SKUs for WCS-STANDARD-K9, WCS-LOC-UPG-K9, WCS-WLSE-UPG-K9 and WCS-ENT-K9 is presented below. To request help with ordering, please contact Cisco Customer Service: http://www.cisco.com/go/customerservice.
    1. Login to the Cisco Ordering Tool.
    2. Enter the family SKU of WCS-STANDARD-K9 or WCS-LOC-UPG-K9 or WCS-WLSE-UPG-K9 or WCS-ENT-K9 into "Enter Product" in the Ordering Tool and then press "Enter."
    3. The family SKU will display in the ordering area. (Figure 6).
    4. Select the "Line" for the family SKU
    5. Once you have been taken to the configuration screen, select one of these options from the left side (Figure 7):
    For WCS-STANDARD-K9 select one of the sub-SKUs based on the following:
    Base: WCS Standard AP Base Option
    Location: WCS Standard AP Location Option
    For WCS-WLSE-UPG-K9 select one of the sub-SKUs based on the following:
    Base: WLSE to WCS AP Base Upgrade Option
    Location: WLSE to WCS AP Location Upgrade Option
    **For WCS-LOC-UPG-K9 select the sub-SKU:
    **WCS AP Location Upgrade Option
    For WCS-ENT-K9 select the sub-SKU:
    WCS Enterprise AP Location Option
    For the WCS-STANDARD-K9 or **WCS-LOC-UPG-K9 SKU families, customers are prompted to order the optional CD (WCS-CD-K9), for a nominal charge, during the ordering process. The WCS-CD-K9 contains one software image of Cisco WCS Software Release 4.1 on a CD for Windows and Linux. This CD is shipped by U.S. mail to the purchaser's address. The optional CD is not available for WCS-WLSE-UPG-K9 because this SKU family already ships in CD format.
    6. The right side of the screen will display the licenses available (Figure 7). The price for each SKU is displayed in the Ordering Tool.
    7. Each license is orderable in a quantity of one (1) for the quantity blocks specified. To add multiple quantities of license blocks, you must go back to the main screen and order additional family SKUs and then select the sub-SKU option and license quantity block required. Repeat this process as needed, until the correct quantity of license blocks for your sub-SKU have been ordered.
    From this good doc;
    http://www.cisco.com/en/US/products/ps6305/pro ducts_data_sheet0900aecd804b4646.html
    Hope this helps!
    Rob

  • Any methods to simulate Cisco IronPort WSA appliance for practice

    Similar to GNS3 on which we can simulate ASA/Routers, same way any other methods to simulate Cisco IronPort WSA appliance for practice or testing? Please let me know. Thanks.

    You can download the virtual WSA. I have not tried it so I'm not sure how it works without a license.
    http://software.cisco.com/download/release.html?mdfid=284806698&flowid=41610&softwareid=282975114&release=7.7.5&relind=AVAILABLE&rellifecycle=GD&reltype=latest

  • NAC Appliance design question

    I have a customer with a central site and two branch office. Routing is configured on the WAN to connect all three locations. All servers and internet access are on the central site.
    Customer wants to install NAC appliance. Do I need a NAC apliance at each location? Or do I just install it at the central location and use that NAC appliance for access control to the two remote sites as well.
    Also how does NAC appliance apply access control to users coming into the network via Citrix or Cisco VPN Clients?
    Thanks

    NAC Appliance (CAM & CAS = Clean Access Manager/Server) can be used in a Layer 3 Out Of Band design. This will provide you with centralized control.
    It works by placing all unauthenticated switch ports into a unathentication VLAN. When a switch port goes up/up, the NAC CAS follows a set of rules you have established on the CAM to make decisions about the computer and user. It then will place that switch port into a VLAN 'dynamically' as dictated by the rules. Your switches must support these features (IOS level) and only Cisco products work with the CAM/CAS (well some others might, but it's a short list). When the port goes down/down the CAS senses this and returns the port to the unauthenticated VLAN.
    For instance, if a user is a vendor, only requiring Internet access, you will have a VLAN for this purpose on all your switches and routed/trunked to your Internet Point of Presence. The CAS will see the switch port he/she jacks into come up/up. It will query the user and the computer and based upon the rules in the CAM, dynamically assign the wire port to the VLAN from the go-no-where unauthenticated VLAN.
    If it were a company user, you could set it to check Anti-virus, levels of service packs, etc. before they were allowed on the network. It could also be set up to allow the person access to only the 'Finance' VLAN (for example) based upon their role in the company. It can do this remotely.
    If you were to remediate VPN users, you could not do this in a dynamic, Out of Band fashion. You would need a second CAS (but not CAM) to operate In Band. This would then allow users in one Interface, traverse the CAS on out another interface on the appropriate VLAN. This is because it's impossible to apply multiple rules to a single port shared by multiple users. You would need a means to make decision on what VLAN the users accesses at the concentrator and move them off dynamically at the virtual interface. It's not supported.
    Remember, NAC is performed at the switch port level. Citrix users would be regarded as local users. You could perform certain rule checking to allow them only onto your Citrix VLAN.
    There is a Cisco Chalk Talk series on the NAC, use the URL below. It will teach you as much as you can absorb on the NAC appliances, how to use them and recommend their purchase to your clients.
    http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/prod_presentation0900aecd80549168.html

  • Margin error: Cisco Wireless Location Appliance 2700

    Hi !
    I'm looking for information about the error margin in the triangulation process for the WLA 2700 Localization service.
    Regards
    Rafa

    3 meters

  • Expanding the NIC on a Cisco 3315 NAC/ISE appliance

    Hi All,
    Is it possible to add another NIC to the Cisco 3315 NAC appliance. It ships with Four ethernet interfaces, but would like to add at least 1 extra interface i.e. PCI card if possible
    thanks
    LD

    Other interfaces can be used for the various probes, like SPAN, DHCP, etc.  Also for inline posture, you can see there are multiple interfaces needed when using high availability.
    References:
    ISE Config Guide - Configuring Probes (note the various probes that have an interface option)
    http://www.cisco.com/en/US/partner/docs/security/ise/1.1.1/user_guide/ise_prof_pol.html#wp1555646
    Cisco Identity Services Engine User Guide, Release 1.1.1, Setting up Inline Posture
    Figure 10-4 Inline Posture Routed Mode High Availability Example
    http://www.cisco.com/en/US/partner/docs/security/ise/1.1.1/user_guide/ise_ipep_deploy.html#wp1140749
    Jatin Katyal
    - Do rate helpful posts -

  • Cisco Wireless Control System need wireless Lan Controller ?

    Cisco Wireless Control System need wireless Lan Controller , for Rogue detection

    Hi Joao,
    The WCS is used in conjuntion with the WLC (Wireless Lan Controller) for Rogue Detection. It is not a must for this function but more of an add-on :)
    The Cisco WCS is an optional network component that works in conjunction with Cisco Aironet Lightweight Access Points, Cisco wireless LAN controllers and the Cisco Wireless Location Appliance.
    From this doc;
    http://www.cisco.com/en/US/products/ps6305/index.html
    Overview of WCS
    The Cisco Wireless Control System (WCS) is a Cisco Unified Wireless Network Solution management tool that adds to the capabilities of the web user interface and command line interface (CLI), moving from individual controllers to a network of controllers. WCS includes the same configuration, performance monitoring, security, fault management, and accounting options used at the controller level and adds a graphical view of multiple controllers and managed access points.
    WCS runs on Windows 2003 and Red Hat Enterprise Linux ES 4.0 and AS 4.0 servers. On both Windows and Linux, WCS can run as a normal application or as a service, which runs continuously and resumes running after a reboot.
    The WCS user interface enables operators to control all permitted Cisco Unified Wireless Network Solution configuration, monitoring, and control functions through Internet Explorer 6.0 or later. Operator permissions are defined by the administrator using the WCS user interface Administration menu, which enables the administrator to manage user accounts and schedule periodic maintenance tasks.
    WCS simplifies controller configuration and monitoring while reducing data entry errors with the Cisco Unified Wireless Network Controller autodiscovery algorithm. WCS uses the industry-standard SNMP protocol to communicate with the controllers.
    From this good doc;
    http://www.cisco.com/en/US/products/ps6305/products_configuration_guide_chapter09186a00806b7270.html#wp1131195
    Detect and Locate Rogue Access Points
    From this WCS doc;
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00806f070a.shtml#new5
    Rogue Detection under Unified Wireless Networks
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml
    Hope this helps!
    Rob

  • Wireless WLC with NAC appliance

    Hi,
    We just design a wireless network and integrated with NAC appliance :
    1. My customer have campus A & campus B, these 2 campus connected with 100Mbps FTTB link, these 2 campus are in different Layer 2 domain.
    2. Both campus A & B have thin APs, but only campus A have WLC.
    3. all wireless users must check by NAC CAS appliance, then access to wired intranet or internet.
    Is the attached network diagram correct or not? Can you share your experiance to me?
    Best Regards,

    You could layer 3 Lwapp in Byuilding A and REAP for access points in Building B

  • What is a Cisco NAC appliance used for?

    We have a 5508 WLC in use already and have this 3310 lying around unused.  I am trying figure out if adding a 3310 would be of any benefit.
    From the documentation, the features of a 3310 NAC are,
    Recognize users, their devices, and their roles in the network
    Evaluate whether machines are compliant with security policies
    Enforce security policies by blocking, isolating, and repairing noncompliant machines
    Provide easy and secure guest access
    Simplify non-authenticating device access
    Audit and report whom is on the network
    What does enforce security polices by blocking, isolating, repairing really mean?
    "Provide easy and secure guest access"  I already have a public wireless ssid set on the wlc.
    I can recognize users in reports like Solarwinds.  I can see the username, IP, MAC, AP location.
    I can get an report from my logging traps collector, Solarwinds.

    Well usually when I have deployed them back in the days, you had a NAC Appliance and another NAC Manager. But what you have read, that is exactly what it does.
    What does enforce security polices by blocking, isolating, repairing really mean?
    It will block and isolate the device if it doesn't meet the requirements that you have set, but the user has to manually repair the items.
    "Provide easy and secure guest access" I already have a public wireless ssid set on the wlc.
    I can recognize users in reports like Solarwinds. I can see the username, IP, MAC, AP location.
    I can get an report from my logging t
    You will not see any username or ap locations. I wouldn't use it as it might be more of a headache to implement unless you know what you are doing.
    Sent from Cisco Technical Support iPhone App

  • Installation of Cisco ISE 1.1.4 on Cisco NAC Appliance 3315

    Hi,
    I am re-imaging the Cisco NAC Appliance 3315 and installing the Cisco ISE 1.1.4...
    After finishing the Installation, when i type "SETUP"... It gives me the below Error;
    # ERROR:  INPUT/OUTPUT ERRORS FOUND DURING THE INSTALLATION!        #
    # PLEASE REIMAGE THE APPLIANCE OR VM FROM THE INSTALLATION MEDIA.   #
    Please advise....
    I tried to change the Time/Date as per UTC/GMT accordingly... But, i didn't find the RAID in CLI... see the link below
    (http://www.cisco.com/en/US/docs/security/ise/1.1.1/installation_guide/ise_app_f-installing_on_NAC-AC.html)
    any idea...
    Regards,
    Mubasher Sultan

    Where did you get the recovery media? Did you download from cisco.com?
    Please download the image from CCO and ensure the ISE image is valid by checking the MD5 checksum of the downloaded image is matching to CCO image.You will then need to burn this ISO image onto bootable DVD.
    Supporting link:
    http://www.cisco.com/en/US/docs/security/ise/1.1/installation_guide/ise_ins.html#wp1134146
    Jatin Katyal
    - Do rate helpful posts -

  • Cisco NAC Appliance

    Hi
    I wanted to know if someone can give me some help on a Cisco NAC appliance.
    Honestly i've heard of them but i've never installed or worked on one before and i
    have a client who wants to have one installed.So i wanted to know can some here
    point me in the right direction as far as installation and configuration. Thanks for
    the help in advance and have a great evening.

    Hi
    Everything you need to get started:
    http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html.
    HTH,
    Tiago
    If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

  • Does Cisco NAC Appliance deployment require CS-ACS?

    I've gone through all the partner training on the Cisco NAC appliance and mgmt station, and CiscoSecure ACS 4.0+ is mentioned just about everywhere in the user verification steps.
    If a customer does not have CSACS, or AAA for that matter (say in just a MS Exchange environment), the NAC appliances can still be used, correct?
    I'm assuming they can, but that leads to if any functionality/checks would be lost in that case, and if so, what?
    Anybody have any ideas on that?
    Thanks!

    Yes, you could use NAC with the local database for a client demonstration. This is actually my preferred method.
    Of course, you would lose the central management functionality which comes with ACS or a hook to Active Directory via KTPass (This command-line tool enables an administrator to configure a non-Windows Server 2003 Kerberos service as a security principal in the Windows Server 2003 Active Directory).
    Though by all means deploy NAC, even if you are simply want to demonstrate its functionality. Configure the authentication portion last, after your customer is happy with the demonstrated results.
    Hope this helps.

  • NAC Appliance - Cisco Clean Access v4.7.0

    Hi,
    I have a nac appliance (lite manager and server) version 4.7.0. Does these device support Windows 7? The last time I check it only support Win XP, 2k, Me, NT, 95, 98 and Vista. But I did not see Windows 7 OS. I want to upgrade the client workstation from Windows XP to Windows 7 but I'm not sure if its going to support by the NAc Appliance I have. Could somebody help me on this? Thanks in advance.
    Richard

    Cisco is also introducing improved abilities to assess the security risk of unmanaged or agentless endpoints/devices, that do not support the CTA and are attempting to gain network access. This is accomplished through collaboration with a new auditing category of NAC partner program vendors. Vendors joining this new category include Altiris, Qualys, and Symantec (through the WholeSecurity acquisition). Collaboration with these vendor solutions helps the NAC framework dramatically improve its ability to assess the risk of agentless devices such as guest laptops, printers, PDAs, and Internet Protocol telephones. These devices can now be audited by this new category of partners. The audit results will then be communicated back to the network to enforce the proper network admission decision.
    http://newsroom.cisco.com/dlls/2005/prod_101805.html

  • NAC Appliance & Cisco Trust Agent

    Hi,
    I have a requirement to implement NAC using the NAC Appliance (Cisco Clean Access). Does anyone know if this will work correctly with CTA in the same way that the NAC framework would do?? I am interested as I wish to use the Cisco Secure Services Client as an 802.1x supplicant and this interfaces directly with the CTA.

    Cisco is also introducing improved abilities to assess the security risk of unmanaged or agentless endpoints/devices, that do not support the CTA and are attempting to gain network access. This is accomplished through collaboration with a new auditing category of NAC partner program vendors. Vendors joining this new category include Altiris, Qualys, and Symantec (through the WholeSecurity acquisition). Collaboration with these vendor solutions helps the NAC framework dramatically improve its ability to assess the risk of agentless devices such as guest laptops, printers, PDAs, and Internet Protocol telephones. These devices can now be audited by this new category of partners. The audit results will then be communicated back to the network to enforce the proper network admission decision.
    http://newsroom.cisco.com/dlls/2005/prod_101805.html

  • Cisco NAC Appliance SSO AD by OU (Organization Unit) is posible?

    Hello, I have a question. it is posible implement NAC Appliance SSO AD VG/Real IP - L2/L3 for OU (Organization Unit), for example; if i have OU sales and OU market in the windows domain X. it is posible restrict the police and assign diferent network (10.1.1.0/24 for OU sales and 10.1.2.0/24 for OU market).
    Regards
    Alvaro

    Yes that is possible, first you will create a user role for the two seperate OU, then you assign a user role vlan to each role. then you will have to create a ldap lookup server. You will then create a attribute condition which will map users that are a memberOf xxx to user role yyy.
    this is for out of band scearios because the clients at first will get the same authenticaiton ip address but after the port is switched over then the ip address they get after will be based off the vlans they land on.
    let me know if you need anything else.
    Tarik

Maybe you are looking for