Class in Session: IT Security

In previous posts, we discussed the authentication component of the NAC Appliance and how the trigger process begins once a host is introduced to the network. In our last discussion I brought up the NAA (NAC Appliance Agent) so let’s dive further into this agent.

The NAA is our “middleware” that allows the NAC Appliance to communicate with your host and check for compliance (aka authorization) and authentication. I mean if you think about it, a NAC Appliance cannot just ask your corporate hosts what software is installed. There are firewalls and all the other software you’ve installed on the hosts, so the only way to query the host is by use of an agent. The agent itself should be installed ahead of time before the Appliances go live at all. So here is the kicker;

1. The agent requires admin rights to be installed.
2. The agent runs as a process under the logged in user and not as a system service (in the next rev this will be updated).

So while you are adding the NAA to the host you should also add a couple of other key components including the “stub installer” and the root CA certificate. The stub installer can be found either by doing an SCP copy from the NAM or browsing into the NAMs GUI to download the exe file. You will want the stub installer because if a user ever downloads the NAA or needs to update their NAA by means of the NAM providing the file, the stub will automatically be invoked to allow the NAA to be installed/patched therefore not requiring your users to have admin rights. (The downfall to installing the stub installer by the way is that the stub itself needs to be installed with admin rights so this will need to be scripted to be automatically installed by your IT staff.)

The CAs certificate will need also to be installed ahead of time or else the users will see a certificate popup window everytime they log in. Remember that the CA will sign the website certificate used on the NAS and NAM.

Also keep in mind the NAA runs as a Process on the local host. That means the user will need to be logged in order to check for any compliance on the host. A user cannot simply leave their PC on yet logout and expect compliance checking to work correctly. Cisco has mentioned that a service version of the NAA will be coming out shortly, but until then we are stuck with the process.

There are also a few sticking points to the agent. If the user logs in to their Windows host and decides to hold the shift key down to prevent any startup programs from starting, the NAA is subjected to the same bypass, preventing the NAA from loading. It’s the same case if a user simply kills the process in TaskManager. In either of those two cases, the users’ PC will be redirected to the web page of the NAC Appliance once they decide to open their browser and browse to the network or Internet.

Author: Jim Thomas

To refresh everyone’s memory, my last few posts have been discussing the Network Admission Control (NAC) Appliance and Framework. So where does this thing called NAC Appliance fit in? Is this technology right for you? Are you ready for NAC? Here is an introduction to the Cisco NAC Appliance and how it differs from the NAC Framework we discussed in those earlier posts.

In October of 2004, Cisco acquired a company called Perfigo. Perfigo was originally responsible for creating the now-known-as NAC Appliances that we’ve grown to love (or hate). Back then, they were known as Clean Access Appliances. When Cisco got a hold of the product they rightfully re-named the product Network Admission Control (NAC) Appliance.

The product has grown over time. If you have been following Cisco for a while you kind of get a feel for how acquisitions turn out. They seem to first acquire an organization, then remove the acquired companies’ label and replace it with their own. After that, they seem to sit on the product for a little while making minor modifications until finally one day, it becomes “Cisco-ized”. This means the product is truly enhanced to meet the expectations that Cisco seems to have met time after time again. We’ll get into that later, but for now we’ll keep our discussion focused on the technology.

Continue reading ‘NAC up your Alley! – NAC Appliance’

When we last left off we were discussing a Cisco NAC Framework scenario using a router. We had discussed the required configuration on the ACS server with ACLs and Attribute Definition Files. But we cannot just get away with only configuring the ACS server and NADs. You must also think about the hosts themselves. Our goal here with NAC is to check for specific software on our hosts.

In order to accomplish this we’ll need some software on the host called Cisco Trust Agent (CTA). Luckily this agent is free from Cisco with a valid CCO account.  CTA is going to be installed on your users’ PCs and is providing middleware services on the host. That means that once the ACS is configured to check for software on the host, the ACS will be querying CTA to check if your host is in compliance. If the host is not in compliance, then a pop-up appears on your users’ PC with a configurable message.

The nice thing here is that we can be pushing down ACLs to the router on the fly giving this user specific access to network resources for remediation (fixing/patching their host). Unfortunately there are quite a few negative components to this tale.

The first being that this technology is slowly (it’s almost gone now) being phased out in lieu of the NAC Appliance. (I mean why use something you already have when you can spend an enormous amount of payola with Cisco on new equipment?)

Continue reading ‘NAC up your alley? Framework Continued…’