Cisco Trust Agent
Cisco Trust Agent (CTA) is a small software application (approximately 3MB) that is installed locally on a PC and that allows Cisco Secure ACS to communicate directly with the PC to query it for posture credentials. Some common posture credentials are the OS name, the service pack installed, and specific hotfixes applied. Table 1-1 lists the posture credentials that CTA supports or for which CTA is a broker.
CTA is a core component of NAC and is the only communications interface between the NAD and the applications that reside on the PC. It receives posture credential queries from Cisco Secure ACS, brokers them to the correct application, and then forwards the application responses to Cisco Secure ACS. CTA has three key responsibilities (see Figure 1-4):
• Communication—Provides a communications link with the NAD using EAPoUDP or EAP-FAST.
• Security—Authenticates the device requesting posture credentials and ensures that all information is sent out encrypted on the wire.
• Broker—Provides an application programming interface (API) to query other applications running on the system and notifies them of the current system posture so they can react to posture changes.
|
Application |
Posture Credentials |
|
CTA (version 2) |
CTA version Operating system name Operating system version Installed service packs Installed hotfixes Custom credentials returned through the optional scripting interface |
|
Cisco Security Agent (CSA)* |
CSA version CSA status (enabled/disabled) Fully qualified domain name (FQDN) of Cisco Security Agent Management Center (CSA-MC) Last poll of CSA |
|
Antivirus* |
Antivirus software name or identifier Software version Scan engine version DAT/pattern file version DAT/pattern file release date Antivirus enabled/disabled On-access scan enabled |
|
Other software* |
Varies by vendor |
*CTA must be installed and acts as a broker agent to forward the posture credentials to Cisco Secure ACS.
*CTA must be installed and acts as a broker agent to forward the posture credentials to Cisco Secure ACS.
Figure 1-4 Responsibilities of CTA
Cisco Trust Agent
AV Client
Any App
Broker / EAP-TLV API
Security
L2/L3 Communications EAPoUDP & EAPo802.1X
Physical Connection
NOTE CTA is involved only in the posture query and response process; it does not take part in any enforcement action on its own. Thus, if a user disables (or removes) CTA, the host becomes clientless (a NAC agentless host). However, it still cannot bypass the NAC validation process and be granted unrestricted access to the network. Instead, the NAC agentless host policy takes effect, which can greatly restrict or even deny access to the network. This is unlike common personal firewall software or antivirus software, in which disabling the application lessens the protection provided.
Software Availability and Operating System Support
CTA is available free of charge to all registered Cisco.com users at http://cisco.com/ cgi-bin/tablebuild.pl/cta. CTA supports the Windows NT, Windows 2000, Windows XP, Windows 2003, Red Hat Linux, and MAC OS 10.3 host operating systems. Internationalization support for CTA includes English, Japanese, Korean, French, Spanish, Arabic, Hebrew, and Russian.
CTA also includes an 802.1X supplicant bundled with it that supports EAP-FAST when running NAC. The 802.1X supplicant is needed to implement NAC-L2-802.1X. However, the 802.1X supplicant is limited to wired interfaces only—no wireless interfaces.
Chapter 2, "Cisco Trust Agent," fully covers the installation, configuration, operation, and troubleshooting of CTA.
Continue reading here: Cisco Wireless Devices
Was this article helpful?