SYMANTEC 10 with NAC

Hi,
I have a problem with a Windows XP station with SP2 in the NAC DOT1X environment. I've already installed the SYMANTEC ADF file in ACS with success.
After I've installed the SYMANTEC client v. 10.1.0.394 in the XP station, it don't put any file and directory \Program Files\Common Files\PostureAgent\Plugins\Install.
So, CTA client can't read the files into the directory to indentify the attributes of SYMANTEC to send to ACS 4.0.
The Posture Validation of OS, service packs and hotfixes works fine in the NAC solution. I'm just have problem with the SYMANTEC.
Does anyone can help me?
Tks

Hi!
If I did undersand well, you need to install Symantec Client Security Posture Plugin, which can be found on Symantec Corporate AV installation media.
Can you share what ADF file have you used? On CD can be found only AVPs for Symantec FW and one more thing I can't remember, but AFAIK it's not AV, and both unsupported.
So second problem is you have possibly wrong AVPs installed.
However, I am not Symantec guru, maybe I am wrong. Mybe someone else could clarify, or tell us where to find Symantec docs for Cisco NAC, because I didn't find anything.
Enjoy!
Astib

Similar Messages

Webroot 6.1 and AVG 9 don't work with NAC

Webroot 6.1 doesn't work with NAC (like AVG 9).
The big problem here is that these programs automatically update themselves to the latest versions. Then users can't login and we (IT) can't really do anything for them except help install a different product that does work.
It's very frustrating.

Mike,
Currently the wait is 60-90 days, but this is being worked on and in later versions we won't have to wait till a new release of agent for new AVs/ASs to be added in.
For now, I agree with you, it's painful, but the only way support is added in CCA.
I just checked the release notes, and Webroot AV 6.x is supported with 4.1.8
HTH,
Faisal

ISe with NAC agent pop up and Posture waiting

Hi,
I have ISE running ver 1.1.1.268. We limited access certain services before authuenticate with ACL-DEFAULT(given below) as per the Trustsec desgin guide.
Now the issue is that when you have ACL-DEFAULT on the port NAC agent doest not pop-up and doest not start the posture part and saying waiting for Posture validation. When the ACL-DEFAULT removed from the access port NAC agent popup and do the posture validation.
However we do not want user to get access to network before the authorization and that is the reason we use the ACL-DEFAULT.
Please can someone advise me how to achieve the above both task. Why the NAC agent does not popup and do the posture when ACL-DEFAULT there in the switch.
Here is what I have configured on ACL-DEFAULT.
ip access-list extended ACL-DEFAULT
remark DHCP
permit udp any eq bootpc any eq bootps
remark DNS
permit udp any any eq domain
permit tcp any any eq domain
permit udp any any eq 389
permit tcp any any eq 135
permit tcp any any eq 445
permit udp any any eq 445
permit tcp any any range 135 139
permit tcp any any eq 389
permit tcp any any eq 3268
permit icmp any any
remark PXE / TFTP
permit udp any any eq tftp
permit tcp any host 172.xx.xx.xx eq 8443 (ISE-Pri)
permit tcp any host 172.xx.xx.xx eq 8443 (ISE-Sec)
remark Drop all the rest
deny ip any any log
Appreciate if someone can give a solid resolution and explanation to this.

Hi Saurav,
We have already allowed those ports with another acl (ACL-POSTURE-REDIRECT). Our issue is not with the web nac agent.
The issue is with NAC agent installed on corperate PCs connecting via wired port. With the ACL-DEFAULT it does not pop-up and does not do the posturing, however once we removed the ACL-DEFAULT from the access port, everything works fine.
Since we do not want any user to access unwanted services before authorization we add this ACL on the access-port and as per the trustsec desgin this has to be there if you want to have ISE with closed mode.
thanks

Authentication mac-move permit with NAC

Hi,
I have 2 switches with NAC configured on it. i also have "authentication mac-move permit" configured on my 2 switches that are connected togther. my understanding is authentication mac-move permit does not work with 802.1x enabled ports.
so i would like to verify i my understanding is correct that if i have authentication mac-move permit configured and a laptop moves to another port without logging off the switch will see that as a violation and block the user right?

anyone run into this before?

Wired WebAuth with NAC Guest Server

Hi,
I am trying to get wired WebAuth working with NAC Guest Server. In the switch_login.html file example, what should be changed for this line:
ngsOptions.actionUrl = https://1.1.1.1/;
Should this be an IP address on the switch? Shoul I have this pointing to the success.html page like this:
ngsOptions.actionUrl = "https://1.1.1.1/success.html";
When I log on, and accept the AUP, my browser just sits there trying to access Https://1.1.1.1/?redirect-url=blah blah blah
Thanks,
Peter

FYI,
In my case I WAS getting the switch_login.html web page being displayed, but after entering credentials and submitting the Acceptable Use Policy page, I did NOT 'see' any radius traffic between the switch (C2960S 12.2(55)SE3) and the ACS 5.3 radius server?!.
I used the sample .html docs that you can find on the NAC Guest Server in the 'samples' folder on that server. I used WCP app to copy them to my PC/laptop before modifying where relevant and copying to flash on switch and to the wireless 'hotspot' folders on the NGS.
I went through the following document in url below line by line, paragraph by paragraph and found that I had left out the following command in the configuration:
aaa authentication login default group radius
see doc at:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_1.99/WebAuth/WebAuth_Dep_Guide.html#wp392553
So I added it in and I am now seeing the radius debug traffic being redirected to the ACS by the switch when a user submits the credentials.
aaa new-model
aaa authentication login default group radius
aaa authentication login VTY-USER-LOGIN local
aaa authentication dot1x default group radius
aaa authorization console
aaa authorization exec EXEC-LOCAL local
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
with debug radius enabled:
Feb 1 13:36:09 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/4, changed state to down
TEST-802.1X#
Feb 1 13:36:10 PST: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/4, changed state to down
TEST-802.1X#
Feb 1 13:36:18 PST: %AUTHMGR-5-START: Starting 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
TEST-802.1X#
Feb 1 13:36:20 PST: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/4, changed state to up
Feb 1 13:36:21 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/4, changed state to up
TEST-802.1X#
Feb 1 13:36:27 PST: %DOT1X-5-FAIL: Authentication failed for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID
Feb 1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-5-START: Starting 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27.367 PST: RADIUS/ENCODE(0000058E):Orig. component type = DOT1X
Feb 1 13:36:27.367 PST: RADIUS(0000058E): Config NAS IP: 10.167.64.74
Feb 1 13:36:27.367 PST: RADIUS/ENCODE(0000058E): acct_session_id: 1421
Feb 1 13:36:27.367 PST: RADIUS(0000058E): sending
Feb 1 13:36:27.367 PST: RADIUS(0000058E): Send Access-Request to 10.167.77.70:1645 id 1645/14, len 211
Feb 1 13:36:27.372 PST: RADIUS: authenticator 2E F0 62 2D 43 D9 7D 2A - 7C 88 0A 52 B9 6E 78 A8
Feb 1 13:36:27.372 PST: RADIUS: User-Name           [1]   14 "848f69f0fcc7"
Feb 1 13:36:27.372 PST: RADIUS: User-Password       [2]   18 *
Feb 1 13:36:27.372 PST: RADIUS: Service-Type        [6]   6   Call Check                [10]
Feb 1 13:36:27.372 PST: RADIUS: Framed-MTU          [12] 6   1500
Feb 1 13:36:27.372 PST: RADIUS: Called-Station-Id   [30] 19 "20-37-06-C8-68-84"
Feb 1 13:36:27.372 PST: RADIUS: Calling-Station-Id [31] 19 "84-8F-69-F0-FC-C7"
Feb 1 13:36:27.372 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:27.372 PST: RADIUS:   11 20 B4 9A B6 E2 56 30 AC EC 43 CD 17 13 3E 14             [ V0C>]
Feb 1 13:36:27.372 PST: RADIUS: EAP-Key-Name        [102] 2   *
Feb 1 13:36:27.372 PST: RADIUS: Vendor, Cisco       [26] 49
Feb 1 13:36:27.372 PST: RADIUS:   Cisco AVpair       [1]   43 "audit-session-id=0AA7404A0000054E16335518"
Feb 1 13:36:27.372 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:27.372 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:27.372 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:27.372 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:27.372 PST: RADIUS(0000058E): Started 5 sec timeout
Feb 1 13:36:27.377 PST: RADIUS: Received from id 1645/14 10.167.77.70:1645, Access-Reject, len 38
Feb 1 13:36:27.377 PST: RADIUS: authenticator 68 CE 3D C8 C3 BC B2 69 - DB 33 F5 C0 FF 30 D6 33
Feb 1 13:36:27.377 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:27.377 PST: RADIUS:   82 3D 31 0A C7 A2 E0 62 D5 B7 6B 26 B8 A0 0B 46            [ =1bk&F]
Feb 1 13:36:27.377 PST: RADIUS(0000058E): Received from id 1645/14
Feb 1 13:36:27 PST: %MAB-5-FAIL: Authentication failed for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-FAILOVER: Failing over from 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-5-START: Starting 'webauth' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'success' from 'webauth' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27.933 PST: RADIUS/ENCODE(0000058E):Orig. component type = DOT1X
Feb 1 13:36:27.933 PST: RADIUS(0000058E): Config NAS IP: 10.167.64.74
Feb 1 13:36:27.933 PST: RADIUS(0000058E): sending
Feb 1 13:36:27.933 PST: RADIUS(0000058E): Send Accounting-Request to 10.167.77.70:1646 id 1646/151, len 100
Feb 1 13:36:27.933 PST: RADIUS: authenticator D0 F0 04 F3 A5 08 90 BE - A9 07 8D 32 1B 0E 93 AC
Feb 1 13:36:27.933 PST: RADIUS: Acct-Session-Id     [44] 10 "0000058D"
Feb 1 13:36:27.933 PST: RADIUS: Framed-IP-Address   [8]   6   10.167.72.52
Feb 1 13:36:27.933 PST: RADIUS: Acct-Authentic      [45] 6   RADIUS                    [1]
Feb 1 13:36:27.933 PST: RADIUS: Acct-Status-Type    [40] 6   Start                     [1]
Feb 1 13:36:27.933 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:27.933 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:27.933 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:27.933 PST: RADIUS: Service-Type        [6]   6   Framed                    [2]
Feb 1 13:36:27.933 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:27.933 PST: RADIUS: Acct-Delay-Time     [41] 6   0
TEST-802.1X#
Feb 1 13:36:27.938 PST: RADIUS(0000058E): Started 5 sec timeout
Feb 1 13:36:27.938 PST: RADIUS: Received from id 1646/151 10.167.77.70:1646, Accounting-response, len 20
Feb 1 13:36:27.938 PST: RADIUS: authenticator C2 DC 8D C7 B1 35 67 D9 - 28 2B 56 E4 4A 1E AD 65
At this point the user enters the credentials on the switch_login.html page and the clicks Submit on the Acceptable Use Policy splash page.
TEST-802.1X#
Feb 1 13:36:41.413 PST: RADIUS/ENCODE(0000058F):Orig. component type = AUTH_PROXY
Feb 1 13:36:41.413 PST: RADIUS(0000058F): Config NAS IP: 10.167.64.74
Feb 1 13:36:41.413 PST: RADIUS/ENCODE(0000058F): acct_session_id: 1422
Feb 1 13:36:41.413 PST: RADIUS(0000058F): sending
Feb 1 13:36:41.413 PST: RADIUS(0000058F): Send Access-Request to 10.167.77.70:1645 id 1645/15, len 176
Feb 1 13:36:41.413 PST: RADIUS: authenticator 6D 34 7E D6 34 B5 CB AC - 09 1F AC 5A 34 97 7D 6B
Feb 1 13:36:41.413 PST: RADIUS: User-Name           [1]   11 "testuser1"
Feb 1 13:36:41.413 PST: RADIUS: User-Password       [2]   18 *
Feb 1 13:36:41.413 PST: RADIUS: Calling-Station-Id [31] 14 "ip|G
Feb 1 13:36:41.413 PST: RADIUS: Service-Type        [6]   6   Outbound                  [5]
Feb 1 13:36:41.413 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.413 PST: RADIUS:   F8 4D 85 64 05 5E C9 1D D8 11 B2 A3 1A 3A 76 E0             [ Md^:v]
Feb 1 13:36:41.413 PST: RADIUS: Vendor, Cisco       [26] 49
Feb 1 13:36:41.418 PST: RADIUS:   Cisco AVpair       [1]   43 "audit-session-id=0AA7404A0000054E16335518"
Feb 1 13:36:41.418 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:41.418 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:41.418 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:41.418 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:41.418 PST: RADIUS(0000058F): Started 5 sec timeout
Feb 1 13:36:41.424 PST: RADIUS: Received from id 1645/15 10.167.77.70:1645, Access-Accept, len 173
Feb 1 13:36:41.424 PST: RADIUS: authenticator 28 48 DE B5 1A 0A 71 5A - 3B 8B 7A 12 FB EA 01 58
Feb 1 13:36:41.424 PST: RADIUS: User-Name           [1]   11 "testuser1"
Feb 1 13:36:41.424 PST: RADIUS: Class               [25] 28
Feb 1 13:36:41.424 PST: RADIUS:   43 41 43 53 3A 78 62 63 2D 61 63 73 2F 31 31 36 [CACS:xbc-acs/116]
Feb 1 13:36:41.424 PST: RADIUS:   34 37 33 32 33 39 2F 31 36 36        [ 473239/166]
Feb 1 13:36:41.424 PST: RADIUS: Session-Timeout     [27] 6   3600
Feb 1 13:36:41.424 PST: RADIUS: Termination-Action [29] 6   1
Feb 1 13:36:41.424 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.424 PST: RADIUS:   10 80 26 5D 02 C5 15 0C A8 16 AA 35 14 C9 4F 14              [ &]5O]
Feb 1 13:36:41.424 PST: RADIUS: Vendor, Cisco       [26] 19
Feb 1 13:36:41.429 PST: RADIUS:   Cisco AVpair       [1]   13 "priv-lvl=15"
Feb 1 13:36:41.429 PST: RADIUS: Vendor, Cisco       [26] 65
Feb 1 13:36:41.429 PST: RADIUS:   Cisco AVpair       [1]   59 "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-GuestACL-4eefc9a0"
Feb 1 13:36:41.429 PST: RADIUS(0000058F): Received from id 1645/15
Feb 1 13:36:41.439 PST: RADIUS/ENCODE(0000058F):Orig. component type = AUTH_PROXY
Feb 1 13:36:41.439 PST: RADIUS(0000058F): Config NAS IP: 10.167.64.74
Feb 1 13:36:41.439 PST: RADIUS(0000058F): sending
Feb 1 13:36:41.439 PST: RADIUS/ENCODE(00000000):Orig. component type = INVALID
Feb 1 13:36:41.444 PST: RADIUS(00000000): Config NAS IP: 10.167.64.74
Feb 1 13:36:41.444 PST: RADIUS(00000000): sending
Feb 1 13:36:41.450 PST: RADIUS(0000058F): Send Accounting-Request to 10.167.77.70:1646 id 1646/152, len 119
Feb 1 13:36:41.450 PST: RADIUS: authenticator 23 E3 DA C3 06 5B 37 20 - 67 E2 96 C5 90 1C 71 33
Feb 1 13:36:41.450 PST: RADIUS: Acct-Session-Id     [44] 10 "0000058E"
Feb 1 13:36:41.450 PST: RADIUS: Calling-Station-Id [31] 14 "10.167.72.52"
Feb 1 13:36:41.450 PST: RADIUS: User-Name           [1]   11 "testuser1"
Feb 1 13:36:41.450 PST: RADIUS: Acct-Authentic      [45] 6   RADIUS                    [1]
Feb 1 13:36:41.455 PST: RADIUS: Acct-Status-Type    [40] 6   Start                     [1]
Feb 1 13:36:41.455 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:41.455 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:41.455 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:41.455 PST: RADIUS: Service-Type        [6]   6   Outbound                  [5]
Feb 1 13:36:41.455 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:41.455 PST: RADIUS: Acct-Delay-Time     [41] 6   0
Feb 1 13:36:41.455 PST: RADIUS(0000058F): Started 5 sec timeout
Feb 1 13:36:41.455 PST: RADIUS(00000000): Send Access-Request to 10.167.77.70:1645 id 1645/16, len 137
Feb 1 13:36:41.455 PST: RADIUS: authenticator 02 B0 50 47 EE CC FB 54 - 2A B6 14 23 63 86 DE 18
Feb 1 13:36:41.455 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:41.455 PST: RADIUS: User-Name           [1]   31 "#ACSACL#-IP-GuestACL-4eefc9a0"
Feb 1 13:36:41.455 PST: RADIUS: Vendor, Cisco       [26] 32
Feb 1 13:36:41.455 PST: RADIUS:   Cisco AVpair       [1]   26 "aaa:service=ip_admission"
Feb 1 13:36:41.455 PST: RADIUS: Vendor, Cisco       [26] 30
Feb 1 13:36:41.455 PST: RADIUS:   Cisco AVpair       [1]   24 "aaa:event=acl-download"
Feb 1 13:36:41.455 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.455 PST: RADIUS:   15 EC 10 E7 2F 67 33 DD BC B5 AE 11 E3 C3 19 E1               [ /g3]
Feb 1 13:36:41.455 PST: RADIUS(00000000): Started 5 sec timeout
Feb 1 13:36:41.455 PST: RADIUS: Received from id 1646/152 10.167.77.70:1646, Accounting-response, len 20
Feb 1 13:36:41.455 PST: RADIUS: authenticator AB 0F 81 95 71 A9 61 E0 - 5B B5 D3 2E 8D A2 68 98
Feb 1 13:36:41.460 PST: RADIUS: Received from id 1645/16 10.167.77.70:1645, Access-Accept, len 560
Feb 1 13:36:41.460 PST: RADIUS: authenticator 64 53 94 79 CF CD 05 B0 - ED 12 5C 5B A0 AB 4F FA
Feb 1 13:36:41.460 PST: RADIUS: User-Name           [1]   31 "#ACSACL#-IP-GuestACL-4eefc9a0"
Feb 1 13:36:41.460 PST: RADIUS: Class               [25] 28
Feb 1 13:36:41.460 PST: RADIUS:   43 41 43 53 3A 78 62 63 2D 61 63 73 2F 31 31 36 [CACS:xbc-acs/116]
Feb 1 13:36:41.460 PST: RADIUS:   34 37 33 32 33 39 2F 31 36 38        [ 473239/168]
Feb 1 13:36:41.460 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.460 PST: RADIUS:   A1 E6 37 EB 60 3A 28 35 92 56 C5 A9 27 7D 2C E9         [ 7`:(5V'},]
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 38
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   32 "ip:inacl#1=remark **Allow DHCP"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 57
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   51 "ip:inacl#2=permit udp any eq bootpc any eq bootps"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 37
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   31 "ip:inacl#3=remark **Allow DNS"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 47
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   41 "ip:inacl#4=permit udp any any eq domain"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 61
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   55 "ip:inacl#5=remark **Deny access to Corporate Networks"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 53
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   47 "ip:inacl#6=deny ip any 10.0.0.0 0.255.255.255"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 45
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   39 "ip:inacl#7=remark **Permit icmp pings"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 38
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   32 "ip:inacl#8=permit icmp any any"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 50
TEST-802.1X#
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   44 "ip:inacl#9=remark **Permit everything else"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 37
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   31 "ip:inacl#10=permit ip any any"
Feb 1 13:36:41.465 PST: RADIUS(00000000): Received from id 1645/16
TEST-802.1X#
TEST-802.1X#
TEST-802.1X#
interface config looks like:
interface GigabitEthernet1/0/4
description **User/IPphone/Guest
switchport access vlan 702
switchport mode access
switchport voice vlan 704
ip access-group PRE-AUTH in
srr-queue bandwidth share 1 30 35 5
queue-set 2
priority-queue out
authentication event fail action next-method
authentication event server dead action authorize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab webauth
authentication priority dot1x mab webauth
authentication port-control auto
authentication fallback WEB_AUTH_PROFILE
mab
mls qos trust device cisco-phone
mls qos trust cos
dot1x pae authenticator
dot1x timeout tx-period 3
auto qos voip cisco-phone
spanning-tree portfast
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY

Antivirus issue with NAC

hello,
i am currently using Microworld Escan antivirus corporate edition 8.0 antivirus server integrated with NAC in the network. I am planning to upgrade the antivirus server from Corporate edition 8.0 to Corporate edition 11.0. As per cisco document, Currently cisco NAC support only Escan Corporate for windows version 8.x only. which means version 11.x is not supported. I want to know,whether cisco will include support for escan corporate edition 11.x with NAC,even in future.
waiting for reply!!!!!!!!!!!!!!!
regards !!!!!!!!!

Hello,
Here are the links to the Windows and MacOS supported AV/AS on NAC 4.8.2:
http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/48/WinAV-AS-vers86.pdf
http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/48/MacOSXAV-AS-ver9.pdf
Regards.

Configure ADSSO with NAC

Hi Guys,
I need to configure my Cisco NAC (ADSSO) with Windows Server 2008 R2 Enterprise (64). For now we only can ADSSO with Windows XP. Windows 7 still using normal authentication. We are using KTPass to authenticate with NAC server. We are using Windows 2008 at 2003 functional level.
Anyone can help me regarding this?
Best Regards,
Azfar

Azfar,
There are a few things that you need to check/perform when configuring ADSSO. First you must check that proper version of ktpass is installed on the machine you generate the kerberos ticket for the CAS service account (I recommend using a different account for this just so you can roll back, also you can not run ktpass successfully more than once for the same service account, please delete the account first, recreate the account and try again):
http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/agntsprt.html#wp228565
After this you need to follow the steps to generate the kerberos ticket:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1301231
Here is an example more specific to your environment:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1277452
Since you are running in a mixed environment you must enable additional algorithms:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1277452
If it fails, then purchase ISE.
Thanks,
Tarik Admani
*Please rate helpful posts*

Cisco 2960 plus, works with NAC?

hi Team, I have a catalyst 2960 Plus, running IOS 15.0(2)EZ, I'm trying sync this device with my Cisco NAC, but I can't and NAC shows this message: NAC: Unable to control 180.124.143.4
NAC version 4.8
So, reviewing the compatibility matrix for NAC and switch, I can´t find the 2960 Plus series.
Is this switch compatible with NAC??
Thanks in advance,
Victor Lenis

Thanks for your reply , I know what's MAB , if you read my explanation again , i mentioned that the user is authenticated in the guest portal which mean that I have web authentication , and it is working fine .. The only issue is that I can not use the vendor1 username as part of authorization condition and this is because the switch is not sending the radius attribute type 1 to the ISE , thus , on the ise authentication log the MAC address of the client machine is shown as a username not the actual username ( vendor1)
as I mentioned also , I have exactly the same setup with ise 1.2 and 3750 switch and I do not have this issue .I experience this with 2960x only .

Wireless WLC with NAC appliance

Hi,
We just design a wireless network and integrated with NAC appliance :
1. My customer have campus A & campus B, these 2 campus connected with 100Mbps FTTB link, these 2 campus are in different Layer 2 domain.
2. Both campus A & B have thin APs, but only campus A have WLC.
3. all wireless users must check by NAC CAS appliance, then access to wired intranet or internet.
Is the attached network diagram correct or not? Can you share your experiance to me?
Best Regards,

You could layer 3 Lwapp in Byuilding A and REAP for access points in Building B

Access switch lost contact with nac profiler

hi all,
We have implement HA for nac profiler using version 3.1.1_18 .My problem is we need manually update for all access switch to connected with nac profiler server and then endpoint detect if i'm don't click button update for all access switch not see the new endpoint .On the acceess switch we configure SNMP cisconac RO and cisconac1 RW .For the SNMP is it needed manually update or automatic if new endpoint connect to the network ?here i'm attach on the my configuration SNMP ..

Hi Larry,
I had the same problem with iTune 10.6.5, and one cannot uninstall it. I was on the phone with Apple wireless support. The solution is to upgrae firmware on the Express, whihc cannot be doen with the latest airport utilities. HOwever, Apple re-posted Airport utility 5.6 for lion, which will then allow you to upgrade the firmware on older Aplle Express Units. This in turn will allow iTune 10.6 to communicate properly wit the Express. Doing so restored my connection to the speakesr without any further issues.
Give it a try...
the utility i sloctaed at:
http://support.apple.com/kb/DL1482?viewlocale=en_US&locale=en_US
Best,
rk007

Wired WebAuth only with NAC Guest Server (No ACS)

Ok, I have been fighting this for two days now. I want to use the webauth function on some of our Cisco 3750Gs ver
12.2(55)SE5 for guest access. I'm trying to use our NAC Guest Server ver: 2.0.3 as the backend portal and Radius server. We do not have ACS or any of the other components of ISE or NAC. I think the issue is the NGS server is not sending the d(ACL) back to switch. Guest work work fine from our WLCs.
switch debug: No Attributes in swtich debug
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Config NAS IP: 199.46.201.26
Mar 22 12:56:00.448 CDT: RADIUS/ENCODE(0000030C): acct_session_id: 1012
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): sending
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Send Access-Request to 10.199.33.20:1812 id 1645/19, len 177
Mar 22 12:56:00.448 CDT: RADIUS: authenticator 99 95 59 55 09 A9 D9 E1 - 2B 01 90 36 1B 8A 41 92
Mar 22 12:56:00.448 CDT: RADIUS: User-Name           [1]   20 "[email protected]"
Mar 22 12:56:00.448 CDT: RADIUS: User-Password       [2]   18 *
Mar 22 12:56:00.448 CDT: RADIUS: Framed-IP-Address   [8]   6   199.46.201.231
Mar 22 12:56:00.448 CDT: RADIUS: Service-Type        [6]   6   Outbound                  [5]
Mar 22 12:56:00.448 CDT: RADIUS: Message-Authenticato[80] 18
Mar 22 12:56:00.448 CDT: RADIUS:   A2 57 B5 F2 A6 FB 46 71 D0 EA 26 54 95 90 F4 D0             [ WFq&T]
Mar 22 12:56:00.448 CDT: RADIUS: Vendor, Cisco       [26] 49
Mar 22 12:56:00.448 CDT: RADIUS:   Cisco AVpair       [1]   43 "audit-session-id=C72EC91A000002FC0A6CD698"
Mar 22 12:56:00.448 CDT: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Mar 22 12:56:00.448 CDT: RADIUS: NAS-Port            [5]   6   50106
Mar 22 12:56:00.448 CDT: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/6"
Mar 22 12:56:00.448 CDT: RADIUS: NAS-IP-Address      [4]   6   199.46.201.26
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Started 5 sec timeout
Mar 22 12:56:01.454 CDT: RADIUS: Received from id 1645/19 10.199.33.20:1812, Access-Reject, len 20
Mar 22 12:56:01.454 CDT: RADIUS: authenticator 92 98 05 84 6E 4B CF DD - B5 D7 90 25 10 59 7B E7
Mar 22 12:56:01.454 CDT: RADIUS(0000030C): Received from id 1645/19
NGS log:
rad_recv: Access-Request packet from host 199.46.201.26 port 1645, id=19, length=177
    User-Name = "[email protected]"
    User-Password = "5rRmpPt9"
    Framed-IP-Address = 199.46.201.231
    Service-Type = Outbound-User
    Message-Authenticator = 0xa257b5f2a6fb4671d0ea26549590f4d0
    Cisco-AVPair = "audit-session-id=C72EC91A000002FC0A6CD698"
    NAS-Port-Type = Ethernet
    NAS-Port = 50106
    NAS-Port-Id = "GigabitEthernet1/0/6"
    NAS-IP-Address = 199.46.201.26
+- entering group authorize {...}
[radius-user-auth]     expand: %{User-Name} -> [email protected]
[radius-user-auth]     expand: %{User-Password} -> 5rRmpPt9
[radius-user-auth]     expand: %{NAS-IP-Address} -> 199.46.201.26
[radius-user-auth]     expand: %{Calling-Station-Id} ->
Exec-Program output:                          Note: no attributes here
Exec-Program: returned: 1
++[radius-user-auth] returns reject
Delaying reject of request 12 for 1 seconds
Going to the next request
Waking up in 0.6 seconds.
Similar debug from NGS but auth request from WLC: See attributes are sent to wlc although not needed
rad_recv: Access-Request packet from host 10.100.16.100 port 32770, id=22, length=152
    User-Name = "[email protected]"
    User-Password = "5rRmpPt9"
    Service-Type = Login-User
    NAS-IP-Address = 10.100.16.100
    NAS-Port = 13
    NAS-Identifier = "ICTWLC01"
    NAS-Port-Type = Ethernet
    Airespace-Wlan-Id = 514
    Calling-Station-Id = "10.198.12.211"
    Called-Station-Id = "10.100.16.100"
    Message-Authenticator = 0xc9383e767f0c228a2b8a0ece7069f366
+- entering group authorize {...}
[radius-user-auth]     expand: %{User-Name} -> [email protected]
[radius-user-auth]     expand: %{User-Password} -> 5rRmpPt9
[radius-user-auth]     expand: %{NAS-IP-Address} -> 10.100.16.100
[radius-user-auth]     expand: %{Calling-Station-Id} -> 10.198.12.211
Exec-Program output: Session-Timeout := 20002004, cisco-AVPair += priv-lvl=15, cisco-AVPair += auth-proxy:proxyacl#1=permit ip any any
Exec-Program-Wait: plaintext: Session-Timeout := 20002004, cisco-AVPair += priv-lvl=15, cisco-AVPair += auth-proxy:proxyacl#1=permit ip any any
Exec-Program: returned: 0
++[radius-user-auth] returns ok
[files] users: Matched entry DEFAULT at line 1
++[files] returns ok
Found Auth-Type = Accept
Auth-Type = Accept, accepting the user
+- entering group post-auth {...}
[sql]     expand: %{User-Name} -> [email protected]
[sql] sql_set_user escaped user --> '[email protected]'
[sql]     expand: %{User-Password} -> 5rRmpPt9
[sql]     expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('[email protected]', '5rRmpPt9', 'Access-Accept', NOW())
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('[email protected]', '5rRmpPt9', 'Access-Accept', NOW())
rlm_sql (sql): Reserving sql socket id: 12
rlm_sql_postgresql: Status: PGRES_COMMAND_OK
rlm_sql_postgresql: query affected rows = 1
rlm_sql (sql): Released sql socket id: 12
++[sql] returns ok
Sending Access-Accept of id 22 to 10.100.16.100 port 32770
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Accounting-Request packet from host 10.100.16.100 port 32770, id=30, length=170
config:
aaa new-model
aaa authentication login default group radius
aaa authentication login console group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization exec default group tacacs+ none
aaa authorization auth-proxy default group radius
aaa accounting auth-proxy default start-stop group radius
aaa accounting exec default stop-only group tacacs+
aaa accounting commands 15 default stop-only group tacacs+
ip device tracking
ip auth-proxy auth-proxy-banner http ^C HawkerBeechcraft Guest Network ^C
ip auth-proxy proxy http login expired page file flash:expired.html
ip auth-proxy proxy http login page file flash:login.html
ip auth-proxy proxy http success page file flash:success.html
ip auth-proxy proxy http failure page file flash:failed.html
ip admission auth-proxy-banner http ^C HawkerBeechcraft Guest Network ^C
ip admission proxy http login expired page file flash:expired.html
ip admission proxy http login page file flash:login.html
ip admission proxy http success page file flash:success.html
ip admission proxy http failure page file flash:failed.html
ip admission name web-auth-guest proxy http inactivity-time 60
dot1x system-auth-control
identity policy FAILOPEN
access-group PERMIT
interface GigabitEthernet1/0/6
switchport access vlan 301
switchport mode access
ip access-group pre-webauth-guest in
no logging event link-status
srr-queue bandwidth share 10 10 60 20
queue-set 2
priority-queue out
mls qos trust device cisco-phone
mls qos trust dscp
no snmp trap link-status
auto qos voip cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input AutoQoS-Police-CiscoPhone
ip admission web-auth-guest
ip http server
ip http secure-server
ip access-list extended PERMIT
permit ip any any
ip access-list extended pre-webauth-guest
permit udp any any eq bootps
permit udp any any eq domain
permit tcp any host 10.199.33.20 eq 8443
permit tcp any host 10.199.33.21 eq 8443
permit tcp any host 10.100.255.90 eq 8443
deny   ip any any log
ip radius source-interface Vlan301
radius-server attribute 8 include-in-access-req
radius-server dead-criteria tries 2
radius-server host 10.199.33.20 auth-port 1812 acct-port 1813 key 7 022E5C782C130A74586F1C0D0D
radius-server vsa send authentication
I get the login and AUP page then the failed page... I never see the priv-lvl 15 or the proxyacl? How do I do this with Guest server only?
Help!

Without the ACS, only with the NAC guest is possible?
They can send me sample configuration?

Wireless Guest with NAC Server

Hi All,
Anyone knows why Sponsor can't create a guest account with 1 month duration.
Its a NAC running on 2.1 version in SNS-3415-K9.
The current setup is WLC connected to NAC Server.
Is it related to Account type?
From the Account Type dropdown menu, you can choose one of the predefined options:
Start End—Allows sponsors to define start and end times for account durations.
From First Login—Allows sponsors to define a length of time for guest access from their first login.
From Creation - Allows sponsors to define a length of time for guest access from the moment of account creation.

When you say, "One MAC user" you mean every other client works except for this one MAC device? If other MAC devices work, then it must be something on the client device that is having issues. The only issue that I have ran into, is html code that might not be supported in certain browsers if you are runing a custom webauth page.

Using Trend AV with NAC

Hi All,
I hope someone con help me!
I have setup NAC II on our network and have got it running without any trouble using Internal Policies on the ACS server.
I am now trying to set it up to use an external validation server, Trend AntiVirus. I have setup the OfficeScan server with a Policy Server and followed the instructions, as well as configuring the ACS server as per the Trend instructions. The two issues I have is I need a Trend Attribute Definition File to import to the ACS server. I am also running into trouble in the 'failed authentication' log, which keeps saying "Could not communicate with external policy server - authentication error". I have not entered a username in the setup as none were specified whtn installing the policy server.
ANY IDEAS, as this is killing me!
Thanks,
Cam

Cam,
Regarding the authentication issue, when I installed the Trend Policy server (OSCE v7.0) I installed it separately and was prompted for the ACS admin user name and password.
To install separately do the following:
a. Go to the \output\PolicyServer directory of
the OfficeScan setup package.
b. Copy the Policy Server setup files.
c. Run setup.exe.
Regards
Pradeep

ACS server with NAC feature

Hi,
I have ACS 3.3 version and i have seen the it has network admission control feature in it. I have cisco switches 3750G and windows servers 2003. Currently i am running machine/user authentication over EAP-PEAP and it seems running ok in my network. I have now a new requirement. we want to authorize the machine only when the machine has latest antivirus running on it. we have symantic antivirus on our machines.
I am new to network admission control and don't know much.
Can i do it with cisco ACS server? is we have to buy any equipment/software to accomplish this? your help in this matter will be highly appriciated.
Regards

This is called NAC framework, and as far as I know this might be possible but you might find some limitations, see the following link for guides:
http://www.cisco.com/en/US/netsol/ns617/networking_solutions_sub_solution_home.html
On the other hand the current NAC solution "Cisco Clean Access" Will allow you to play with it as desired, see:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/product_data_sheet0900aecd802da1b5.html
hth
Ivan

L2 or l3 switch with NAC appliance

Hi,
I am planning for deploying NAC appliance in OOBVG mode. For the access layer, L2 switches are selected (2960). If I change the L2 access switches with L3 (3560 or 3750) would this add more manageability to the access layer by NAC?
Regards,
Mladen

Thanks.
The document "Cisco NAC Appliance - Clean Access Manager Installation and Configuration Guide" says:
"In out-of-band Real-IP or NAT gateway deployment, the client IP address has to change when the port is changed from the Auth VLAN to the Access VLAN."
So the clients will have to receive TCP/IP settings via DHCP twice, which I don't think is client satisfactory.
If the NAC is in OOBVG mode, are there any NAC features, which are not supported (IP filtering rules, access policies, and any other traffic handling mechanisms)?
Regards,
Mladen

SYMANTEC 10 with NAC

Similar Messages

Maybe you are looking for