Traffic Control in NAC

Hi all,
Is it possible to control traffic after user is authenticated by NAC? For example, a user can only access the server segment, not to other segment. From what i understand, after user is authenticated by NAC, that user is put to trusted segment and server segment is also in trusted segment, so i think it is not possible. Maybe other have another opinion?
Thanks.

Hi Brian,
You can keep controlling traffic with NAC if you have a Clean Access Server (CAS) deployed inline for example:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_trfpol.html
Regards,
Fede
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Similar Messages

ALV Grid Traffic control Example program implemented with function modules

Hi Friends,
Can any one please give me ALV Grid control traffic lights example program implented using function modules instead of OOP ALV. It is very urgent,
Thanks in advance,
Santosh Kumar.

Hi Santosh ,
Here is a sampla code for the same
TYPE-POOLS : SLIS.
DATA : BEGIN OF IT_1 OCCURS 0 ,
           MATNR TYPE matnr ,
           FLAG TYPE C , " added for the traffic control
       END OF IT_1.
SELECT MATNR INTO TABLE IT_1 " Select Data
UP TO 10 ROWS
FROM MARA.
DATA : CATALOG TYPE SLIS_T_FIELDCAT_ALV ,
       WA_CATALOG TYPE SLIS_FIELDCAT_ALV ,
       LAYOUT TYPE SLIS_LAYOUT_ALV .
*" create catalog
WA_CATALOG-FIELDNAME = 'FLAG'.
WA_CATALOG-TABNAME = 'IT_1'.
APPEND WA_CATALOG TO CATALOG.
WA_CATALOG-FIELDNAME = 'MATNR'.
WA_CATALOG-TABNAME = 'IT_1'.
APPEND WA_CATALOG TO CATALOG.
DATA : FLAG_T TYPE I.
*"assign value to traffic signal
LOOP AT IT_1.
FLAG_T = SY-TABIX MOD 2.
IF FLAG_T = 0.
IT_1-FLAG = '1'.
ELSE.
IT_1-FLAG = '2'.
ENDIF.
MODIFY IT_1.
ENDLOOP.
*"specify the traffic signal field in the layout
LAYOUT-LIGHTS_FIELDNAME = 'FLAG'.
CALL FUNCTION 'REUSE_ALV_GRID_DISPLAY'
EXPORTING
*   I_INTERFACE_CHECK                 = ' '
*   I_BYPASSING_BUFFER                =
*   I_BUFFER_ACTIVE                   = ' '
*   I_CALLBACK_PROGRAM                = ' '
*   I_CALLBACK_PF_STATUS_SET          = ' '
*   I_CALLBACK_USER_COMMAND           = ' '
*   I_CALLBACK_TOP_OF_PAGE            = ' '
*   I_CALLBACK_HTML_TOP_OF_PAGE       = ' '
*   I_CALLBACK_HTML_END_OF_LIST       = ' '
*   I_STRUCTURE_NAME                  =
*   I_BACKGROUND_ID                   = ' '
*   I_GRID_TITLE                      =
*   I_GRID_SETTINGS                   =
   IS_LAYOUT                         = LAYOUT
   IT_FIELDCAT                       = CATALOG
*   IT_EXCLUDING                      =
*   IT_SPECIAL_GROUPS                 =
*   IT_SORT                           =
*   IT_FILTER                         =
*   IS_SEL_HIDE                       =
*   I_DEFAULT                         = 'X'
*   I_SAVE                            = ' '
*   IS_VARIANT                        =
*   IT_EVENTS                         =
*   IT_EVENT_EXIT                     =
*   IS_PRINT                          =
*   IS_REPREP_ID                      =
*   I_SCREEN_START_COLUMN             = 0
*   I_SCREEN_START_LINE               = 0
*   I_SCREEN_END_COLUMN               = 0
*   I_SCREEN_END_LINE                 = 0
*   IT_ALV_GRAPHICS                   =
*   IT_ADD_FIELDCAT                   =
*   IT_HYPERLINK                      =
*   I_HTML_HEIGHT_TOP                 =
*   I_HTML_HEIGHT_END                 =
*   IT_EXCEPT_QINFO                   =
* IMPORTING
*   E_EXIT_CAUSED_BY_CALLER           =
*   ES_EXIT_CAUSED_BY_USER            =
TABLES
    T_OUTTAB                          = IT_1
* EXCEPTIONS
*   PROGRAM_ERROR                     = 1
*   OTHERS                            = 2
IF SY-SUBRC <> 0.
* MESSAGE ID SY-MSGID TYPE SY-MSGTY NUMBER SY-MSGNO
*         WITH SY-MSGV1 SY-MSGV2 SY-MSGV3 SY-MSGV4.
ENDIF.
so rem all you need to do is add a feild in internal table for the traffic signal , assign values 0 , 1, 2 to it and last specify the name of this feild in the layout.
Regards
Arun

Multicast IPv6 - Traffic Control

Hi Guys,
We have a Deployment Multicast IPv6, and actually i need traffic control over interface that have EoMPLS configured; what is the best configuration for traffic control (4Mb up and 4Mb down of traffic Multicast).
Or which are the best practices for deployment control traffic in Multicast IPv6?
Thx in advance!

Hi,
It seems you are running EoMPLS with ethernet port mode.
you could do bandwidth managment of traffic shaping on the subinterface each PE.
HTH
Mohamed

Air Traffic Control Widget Does Not Work With OS 10.6.8

Air Traffic Control Widget Does Not Work With OS 10.6.8.
Any suggestions?
SR

No I have not. I have thought about just downloading another version...
Thanks for your reply.
SR

Condtions for out put controls by NACE

HI
H0w to GET the application for production order as co in condtions for output controls whic has t/code NACE.
Regards
Baswaraj

Hi,
I am not creating any Systemaction (No body can creat it ).
I useing the Hyperlink System action .
I am adding a Push button with a system action hyperlink and Draging the filed where we will enter the URL in Runtime into Hyperlink address .
If you enter the address in Inputfield and After pressing the Submit button .
It will navigate to your URL browser.
Regards,
Govindu

Ssid traffic control

Hi, I'd like to control the overall ssid traffic coming from the access-point. I'd like to force the destination MAC address to be equal to the MAC of the firewall connected on the ssid vlan.
Where can I place the control ? on the AP or on the switch connected to the AP ?
All that to avoid traffic from wireless IP to the wired IP on the same ssid vlan.
thank you in advance
RS

Hi, I forgot to say that for technology limit I cannot implement user AAA on wireless client.
thank you
RS

Traffic Policies IN NAC

Hello friends,
For host remediation we shld allow for access to a particular destination or by default it is accessible?????
OR
traffic policies are applied after a host passes posture assessment and remediation.??? to limit network access.
Thanks

Hello Faisal,
Thanks for reponse,
My setup is IN-band virtual mode.
From ur mail what i understand is if the host want to succeed posture assesment he has to be permited for the particular destination.
for example: host is not updated with full AV then he has to permit access to AV server for the updates in the temporary role,
access-list will be like : permit tcp any host 10.10.10.10 (AV Server) eq (port)
correct me if i m wrong ?????
2) After host get success in host posture assessment after that also we can limit the host for a particular destination.
where is option that we can specify such access-list.
Thanks

Cisco nac access control

Dear All,
I have depolyed a cisco nac solution in inband virtual gateway mode.Everything is working fine.The issue is that i want to restrict intranet server access.Usually there is a web server configured on it and users can access by typing http://intranet.There are also shared resources on it.
I want certain users to be able to access shared ressources but not access the intranet by typing http://intranet.I created access rules in traffic control to deny tcp protocol from the specified source to the destination ip address of the server on port 80and permit everything else.Users continue to access both ressources.
Since it was not working, created access-list on the L3 3560 switch to deny connection on 172.31.0.3:80 and permit everything else and applied it to the users vlan svi.Still it does not work.
How can i make it happen ?Please help.
Thanks

Yes Sir.. Check this link for supported devices with Cisco ISE
http://www.cisco.com/en/US/docs/security/ise/1.0.4/compatibility/ise104_sdt.html
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

NAC OOB VIRTUAL GW PROBLEM

Hi,
I am trying to setup a NAC OOB Virtual GW Scenario (attached is the visio schematic of the setup):
Switch: 3550 (ios 12.2(46) adv ip serv)
NAC 4130 appliances: v4.1.6 (also tried v4.5)
Switch Configuration of the trunks to the CAS):
- int f0/23 (connected to CAS e0) -> dot1q trunk with native vlan 999 and allowed vlans 199 (mgt vlan of cas) and 10 (hosts access vlan)
- int f0/21 (connected ro CAS e1) -> dot1q trunk with native vlan 998 and allowed vlans 100 (hosts authentication vlan)
- SVIs on switch: 199, 10, 200 (CAM mgt vlan), 99 (dns, dhcp)
The problem I am facing is that the host once connected to a managed port is able to acquire an ip from the access vlan from the dhcp server but is not redirected to the login page. I tried to follow some hints provided in previous posts but none of them worked for me. I configured the following:
- Login Page
- Configured IP based traffic control on the unautheticated role to permit all traffic (also host based to permit https://192.168.199.1 -> cas' ip with trusted dns my dns server 192.168.99.1)
- Managed subnet with unused ip in access vlan (192.168.10.253) and vlan id that of the auth vlan (100)
- vlan mapping between untrusted vlan 100 and trusted vlan 10
- tried to access a resolvable website by my dns from the host (as per the suggestion from a previous post for someone who was facing the same prob)
- also tried to access the cas' login page from the host with vain, eventhough it is accessible from trusted subnets
Note: I followed the configuration guide of both v4.1.6 and v4.5 and with both versions I was facing the same problem.
I would be very thankful for any hints to help me solve this issue.
Questions: When the host is connected to a managed host (assigned to the managed vlan 100) and it is assigned an ip from the a access vlan 10. Shouldn't I be able to access the managed subnet case I configured ip traffic control policy to permit all traffic from untrusted to trusted? also shouldn't I be able to resolve website's ip with "nslookup x.com" since dns traffic is by default configured and also trusted dns server 192.168.99.1 is configured?
Thanks in advance for any help.

It arised to be that the 3550/3560/3750 are not supported for Central Deployment. The problem is solved.
Cisco Catalyst 3550/3560/3750 and NAC Appliance In-Band Central Deployment
For Cisco Clean Access (NAC Appliance) in In-Band Central Deployment mode, when a Cisco Catalyst 3560/3750 series switch is used as a Layer 3 switch and if both ports of the Clean Access Server (CAS) are connected to the same 3560/3750 switch, the minimum switch IOS code required is Cisco IOS release 12.2(25)SEE.
Because caveat CSCdu27506 is not fixed on the Catalyst 3550 series switch, when the Catalyst 3550 is used as a Layer 3 switch, it cannot be used in NAC Appliance In-Band Central Deployment.
For further details, refer to switch IOS caveat CSCdu27506:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCdu27506
See also Switch Support for CAS Virtual Gateway/VLAN Mapping (IB and OOB).
Switch Support for CAS Virtual Gateway/VLAN Mapping (IB and OOB)
Table 6 describes Cisco Catalyst switch model support for the Virtual Gateway VLAN Mapping feature of the Clean Access Server for either in-band (IB) or out-of-band deployments (OOB). This table is intended to clarify CAS network deployment options when connecting the CAS in Virtual Gateway (bridge) mode to the switches listed.
Table 6 Switch Support for CAS Virtual Gateway In-Band/OOB VLAN Mapping Feature
Cisco Catalyst Switch Model Virtual Gateway
Central Deployment
(both interfaces into same switch) Edge Deployment
(each interface into different switch)
6000/6500 Yes Yes
4000/4500 Yes Yes
3750/3560 (L3 switch) Yes with 12.2(25) SEE and higher 1
Yes
3550 (L3 switch) No 1
Yes
3750/3560 (L2 switch) Yes Yes
3550 (L2 switch) Yes Yes
2950/2960 Yes Yes
2900XL No 2
Yes
3500XL Yes Yes
28xx NME Yes with 12.2(25) SEE and higher 1
Yes
1 Due to switch caveat CSCdu27506. See Cisco Catalyst 3550/3560/3750 and NAC Appliance In-Band Central Deployment for details.
2 2900 XL does not support removing VLAN 1 from switch trunks.

NAC 4.8 File distribution issue

Hi,
I upgraded my NAC deployment from 4.7.2 to 4.8 but i had a problem, one of the requeriments (with file distibution rememediation) didn't work. This take a lot of time when NAC try to download the file and then appear and error message in the agent. I cheked the configuration (The rule in the traffic control for to pass the traffic from Untrusted interface to CAM by ports 80 and 443) and the file size is at most 5MB. Any problem with the new release of NAC and the file distribution??
Thanks,
Jorge

Hi All,
Not that there was a ton of help, but I got it sorted myself. Turned out that I needed to tag the management vlan on the eth0 interface.
The cisco NAC appliance hardware document is pretty vague around this setting, but it turns out I had to tag the management vlan on that port to allow the CAS to connect to the CAM.
Now to try to workout why a simple layer 2 connection between the two eth2 interface on my CAS servers for the heartbeats isn't communicating....any ideas of this.....anyone?
JS

Nac remediation failed

Hi All,
Anyone encountered this issue. Recently upgraded to 4.9. Using L2 OOB wireless. Symantec endpoint protection ver 11, virus definition is out of date, when user clicked repair, takes a long time to remediate and then gave a failed error. "The remediation you are attempting had a failure. If the problem persist contact the system admin"
Traffic control is allowing update in temporary role, and there's no blocking from quarantine vlan to symantec server. Also we notice that the definition gets updated after a while.
Thanks.
Regards
Joachim

Hi Joachim,
In my enviroment, we have workstations with SEP ver 11 too and i would like to know where your users are searching for updates during the remediation process.
We have Symantec Endpoint Protection Manager acting as antivirus server and when the NAC Agent calls the Symantec LiveUpdate to perform the repair, users will get updates on the Internet and not on
Antivirus Server.
Could you give me more information about your environment?
regards,
Daniel Stefani

NAC OOB logoff feature not working

Hi all,
I've deployed NAC in L2 OOB VG mode with ADSSO and I'm trying to use the OOB logoff feature but it's not working. The VLAN change detect feature doesn't work either (I think the two problems might be related).
It will work if each user role is assigned a different auth/access VLAN pair but in my setup, everyone has a common auth vlan and separate role-based access vlans. Because of this, I have to use the IP refresh feature as well (this works fine).
I'm running Windows Vista and version 4.8.0 of the NAC software with version 4.8.1.5 of the agent
I checked the release notes and found that caveat CSCth60233 identifies this bug with the VLAN change detect with the workaround being to refresh the IP address automatically after being logged out. Does anyone know of a workaround for this problem to do this automatically? Is a solution for this problem in the works?
Also would anyone be able to help me with my OOB logoff feature not working? I've configured everything according to the documentation.
I appreciate your responses
~Xavier

Here are my configs if necessary. Tell me if anything else is needed.
User Management > User Roles
List of Roles
Edit Role
Traffic Control
Bandwidth
Schedule
Disable this role
Role Name
Role Description
Role Type
Normal Login Role Quarantine Role
*Max Sessions per User Account             ( Case-Insensitive Session Identifiers             )
(1 – 255; 0 for unlimited)
Retag Trusted-side Egress Traffic with VLAN (In-Band)
(0 – 4095, or leave it blank)(*This option has been deprecated, and it will be removed in upcoming releases)
*Out-of-Band User Role VLAN
VLAN ID VLAN Name                 (if left blank, it will default to the default access vlan             settings in the Port Profile)
*Bounce Switch Port After Login (OOB)
Enable               Disable               (This option is effective only when port profile is set to use it)
*Refresh IP After Login (OOB)
Enable               Disable               (This option only applies to L2 OOB Virtual Gateway with Role VLAN             as Access VLAN and switch port is NOT bounced after VLAN change)
*After Successful Login Redirect to
previously requested URL
this URL:
(e.g. http://www.cisco.com/)
Redirect Blocked Requests to
default access blocked page
this URL or HTML message:
*Show Logged-on Users
User info
Logout button
Enable Passive Re-assessment                          (To enable Passive Re-assessment for OOB Agent             connections, you must also enable the OOB Logoff option at             Device Management > Clean Access > General Setup > Agent Login.)
Re-assessment Interval
(Minimum of 60 minutes and maximum of 1440 minutes [24 hours])
Grace Timer
(Minimum of 5 minutes and maximum of 30 minutes)
Default action on failure
Continue Allow user to remediate Logoff user immediately
(*only applies to normal login role)
Device Management > Clean Access
Certified Devices
General Setup
Network Scanner
Clean Access Agent
Updates
            Web Login   · Agent Login
User Role
Unauthenticated Role(not common) role_engineer role_developer role_admin role_sales role_guest
Operating System
ALL WINDOWS_ALL WINDOWS_XP WINDOWS_VISTA_ALL WINDOWS_7_ALL MAC_ALL MAC_OSX LINUX FREEBSD SOLARIS_ALL SOLARIS_86 SOLARIS_SPARC UNIX VMS OS2 PALM
(By default, 'ALL' settings apply to all client operating systems if no OS-specific settings are specified.)
Enable OOB logoff for Windows NAC Agent and Mac OS X Agent        (This global option applies to all OOB CASs and user roles and enables Agent logout and heartbeat timers for OOB Agent connections. You must also enable this option for Passive Re-assessment to function with OOB Agent connections.)
Require use of Agent
(for Windows & Macintosh OSX only)
Agent Download Page Message (or URL):
           Network Security Notice: This network is protected by a Cisco NAC Appliance Agent, a component of the Cisco NAC Appliance Suite. The Agent ensures that your computer meets the requirements for accessing this network, and helps you keep your computer secure and up-to-date.
Please use the Agent to log in to the network.
If you don't have the Agent software yet, download it by clicking the button below. After downloading the installation file, run it to complete the installation.
If you have already downloaded and installed the Agent, please close this window and right-click the Agent icon in the system tray and choose Login from the menu. Enter your usual network user name and password in the login window.
Require use of Cisco NAC Web Agent (for Windows only)
          Cisco NAC Web Agent Launch Page Message (or URL):
Network Security Notice: This network is protected by the Cisco NAC Web Agent, a component of the Cisco NAC Appliance Suite. The Cisco NAC Web Agent ensures that your computer meets the requirements for accessing this network, and helps you keep your computer secure and up-to-date.
Please launch Cisco NAC Web Agent by clicking the button below.
Allow restricted network access in case user cannot use   NAC Agent or Cisco NAC Web Agent
          Restricted Access User Role:
role_engineer role_developer role_admin role_sales role_guest
          Restricted Access Button Text:
Restricted Network Access Message:
           Restricted Network Access: If you cannot use a Cisco NAC Appliance Agent, you can obtain restricted network access temporarily by clicking the button below.
Show Network Policy to NAC Agent and Cisco NAC Web Agent users (for Windows only)
          Network Policy Link:
Logoff NAC Agent users from network on their machine logoff or shutdown after
    secs (for Windows & In-Band setup, for OOB setup when OOB Logoff is enabled)
     (Setting the time to zero secs will logout user immediately. Valid range: 0 - 300 secs.)
Refresh Windows domain group policy after login
(for Windows only)
Automatically close login success screen after
    secs
     (Setting the time to zero secs will not display the login success screen. Valid range: 0 - 300 secs.)
Automatically close logout success screen after
    secs
(for Windows only)
     (Setting the time to zero secs will not display the logout success screen. Valid range: 0 - 300 secs.)

NAC and Allowing NFS Mounts

When a linux system boots, the 'root' processes typically attempts to mount network drives via NFS, prior to any user login on the system. In NAC, is it sufficient to add in the User Roles->Traffic Control->Unathenticated Role allowing TCP/UDP ports 111 & 2049 for the NFS mount process to work? We're using NAC v4.7.1
Thanks,
Doug

Doug,
If those two ports are what your NFS uses, then yes, opening them up in Unauthenticated role should be sufficient!
HTH,
Faisal

Error with GPOs on Cisco NAC

I have cisco nac deployed inband, all PCs had the CCA Agent deployed via a gpo before the migration. Now that all the systems are behind NAC inband, none of the systems will process GPOs, Machine or user policies. I have the unauthenticated role allowing all traffic to all the domain controllers, but with no luck. If i move the PC to a vlan that is not trunked to the CAS the GPOs process with no problem. Any ideas...?

I think the ports list in the CAS Manual is not complete. Try this list of ports from the CAM Manual chapter:User Management: Traffic Control, Bandwidth, Schedule
Allow TCP *:* Server/255.255.255.255: 88
Allow UDP *:* Server/255.255.255.255: 88
Allow TCP *:* Server/255.255.255.255: 389
Allow UDP *:* Server/255.255.255.255: 389
Allow TCP *:* Server/255.255.255.255: 445
Allow UDP *:* Server/255.255.255.255: 445
Allow TCP *:* Server/255.255.255.255: 135
Allow UDP *:* Server/255.255.255.255: 135
Allow TCP *:* Server/255.255.255.255: 3268
Allow UDP *:* Server/255.255.255.255: 3268
Allow TCP *:* Server/255.255.255.255: 139
Allow TCP *:* Server/255.255.255.255: 1025

Cisco NAC policy sync

I have a failover CAM configured, one is configured as the Master and the other one is receiver.
when I do manual sync between them this is what happen:
Successfuly completed pre-sync check with 10.10.80.248
then I click continue it fails to sync:
this is the log :
*************** Master Log ***************
Starting policy import/export on Policy Sync Master.
Created dump file for policy: Device Management > Filters > Devices (all Access Types other than ROLE and CHECK)
Created dump file for policy: User Management > User Roles > List of Roles/Schedule
Created dump file for policy: Device Management > Clean Access > Clean Access Agent > Role-Requirements
Created dump file for policy: Device Management > Filters > Devices (Access Type ROLE and CHECK only)
Created dump file for policy: User Management > Traffic Control > IP
Created dump file for policy: User Management > Traffic Control > Host
Created dump file for policy: User Management > Traffic Control > Ethernet
Dump file creation is complete.
Created policy import/export dump file.
No file available for policy sync as large object.
Created policy import/export header file.
Created policy import/export tar file.
*************** Receiver Log ***************
Starting policy import on Policy Sync Receiver.
Hash value is a match.
Policy Sync Master and Receiver CAM versions match.
The Policy Sync Reciever is not active, Please retry policy sync later.
Failed to store all policies on Policy Sync Receiver.
Receiver failed sync

Hi,
Please note that this feature is not meant to be used between 2 CAMs of an HA pair.
As you can see on the config guide:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cam/m_admin.html#wp1050935,
- All CAMs must run release 4.5 or later to enable Policy Sync.
- On CAM HA-pairs, Policy Sync settings are disabled for the Standby CAM.
So, this means you can use this feature only in active CAMs or Standalone CAMs.
In HA pairs, Only the Active CAM will be active for this feature.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Traffic Control in NAC

Similar Messages

Maybe you are looking for