Understanding NAC Framework Communications
Although this chapter isn't meant to be a tutorial on NAC, it is helpful to have a basic understanding of how NAC Framework functions. Be aware that the descriptions provided are applicable to NAC Framework only. NAC Appliance functions similarly, but also contains significant differences in how the various components communicate, as described in the sections that follow.
Endpoint, or Personal Computer
You must install an agent, known as the Cisco Trust Agent (CTA), on each computer that is going to be posture-checked. This agent is responsible for communicating with the operating system, antivirus applications, personal firewalls, and other software that NAC
will be checking. The CTA also communicates with an 802.1x supplicant, if one is installed on the computer.
CTA is included in several other software applications, including Cisco Security Agent (CSA) and some antivirus applications.
NOTE The 802.1x protocol is a standard, port-based, network access control protocol. This means that it performs authentications of the computer and user before the host receives an IP address through Dynamic Host Configuration Protocol (DHCP). This contrasts with NAC, which relies on IP for authentication and posture checking.
To support 802.1x in your network, you must have a network infrastructure that supports it, and you must also have operating system support, or a supplicant installed on each computer.
The 802.1x protocol is commonly used to secure enterprise wireless networks.
Supplicants securely authenticate to the network, whether wired or wireless, before being granted access to the network. Authentication (through the supplicant) and posture checking (through the CTA) are natural components to combine. In fact, some supplicant vendors, as well as antivirus vendors, include the CTA as part of their individual products. Cisco offers CTA at no charge to anyone wanting to use it.
The CTA communicates with the NAD securely, using either Extensible Authentication Protocol (EAP) over 802.1x or over User Datagram Protocol (UDP).
Network Access Devices (NAD)
NADs are Cisco access routers, Virtual Private Network (VPN) gateways (VPN 3000 series), PIX and ASA firewalls, Catalyst switches, and wireless access points that are configured to watch for endpoints that are required to be posture-checked.
Posture checking is triggered when a host becomes active on the network or when a host begins communicating through a Layer 3 device. For example, posture checking would be triggered when a host is connected to a switch or when a VPN tunnel is established to a VPN device or firewall.
The NAD communicates to the CTA on the endpoint using EAP over either UDP or 802.1x. The NAD communicates also to the authentication, authorization, and accounting (AAA) server.
AAA Server
Cisco Secure ACS is the Cisco AAA server with support for NAC. The AAA server functions as the policy decision point. This is where individual checks are defined that determine the posture tokens assigned to endpoints.
Communication between the NAD and the AAA server is through Remote Authentication Dial-In User Service (RADIUS). The AAA server can optionally communicate with a posture validation server.
Posture Validation Server
In a large environment, it would be tedious to regularly update the checks and policies defined in the AAA server. Rather than manually define antivirus scan engine versions, .dat file versions, and dates, it is much more scalable to simply delegate this function to a third-party posture validation server. This is a server, such as McAfee's or Trend Micro's antivirus management station, that already keeps track of the most recent information regarding the antivirus versions and dates. The AAA server can gain access to this information by configuring Host Credentials Authorization Protocol (HCAP).
Putting It All Together
The following steps describe a sample posture check, using NAC Framework:
1 A payroll clerk logs in to her computer at ACME Gadgets and Gizmos. Because the network doesn't yet know and trust this host, it is temporarily placed in an isolated VLAN.
2 The EAP supplicant verifies that the computer is owned by ACME Gadgets and Gizmos and passes the user's Windows authentication seamlessly to Cisco Secure ACS.
3 Upon successful authentication, the Cisco switch, functioning as a NAD, challenges the CTA on the computer for posture information, using EAP over 802.1x. It requests Windows operating system versions and information, as well as hot fixes and antivirus information.
4 The CTA on the computer verifies the authenticity of the NAD and passes the requested information back to the NAD using EAP over 802.1x.
5 The switch passes the information directly to Cisco Secure ACS, using the RADIUS protocol.
6 Cisco Secure ACS receives the information and consults the defined posture rules.
7 The policy is configured to require Trend Micro antivirus, with all files current to within two days. Using HCAP, ACS queries Trend Micro's AV server for valid versions.
8 If the host is compliant with the requirements, ACS uses RADIUS to assign a Healthy token and provide it to the Cisco switch.
9 The switch returns Healthy to the CTA on the PC, using EAP over 802.1x, and also changes the switch port to the Payroll VLAN, which is where the end user works.
The entire process takes just 1-2 seconds.
Continue reading here: Custom Parser for Cisco CSC Module
Was this article helpful?