Cisco Network Admission Control, Volume I: Nac Framework Architecture and Design

Cover......Page 1
Contents......Page 9
Introduction......Page 16
 What Is Network Admission Control?......Page 22
  Cisco NAC Technology Progression......Page 23
  Accessing a Network That Does Not Implement NAC......Page 24
  Accessing a NAC Network......Page 25
 NAC Benefits......Page 26
 NAC Framework Components......Page 27
  NAD Requirements......Page 29
  Cisco Secure ACS Requirements......Page 31
 NAC Framework Operational Overview......Page 32
 NAC Framework Deployment Scenarios......Page 35
 Summary......Page 37
 Review Questions......Page 38
 NAC Framework Authorization Process......Page 42
 Posture Token Types......Page 45
  Host Credential Information......Page 47
  Arbitrary Information Collection with Cisco Trust Agent Scripting......Page 49
  NAC Agentless Auditing......Page 50
 NAC Modes of Operation......Page 52
 NAC Communication Protocols......Page 53
  Client-Side Front-End Protocols......Page 54
  Server-Side Protocols......Page 55
 NAC-L3-IP and NAC-L2-IP Posture Validation and Enforcement Process......Page 56
  NAC-L3-IP and NAC-L2-IP Status Query......Page 58
  NAC-L3-IP and NAC-L2-IP Revalidation......Page 59
 NAC-L2-802.1X Identity with Posture Validation and Enforcement Process......Page 60
 NAC Agentless Host Auditing Process......Page 63
  ACL Types......Page 66
  Cisco Trust Agent and Posture Plug-in Actions......Page 67
 Summary......Page 68
 Review Questions......Page 69
 Posture Agent Overview......Page 74
 Cisco Trust Agent Architecture......Page 76
  Posture Agent Plug-in Files......Page 80
  Operating System Support......Page 81
 Posture Plug-in Functionality......Page 83
  Cisco Trust Agent Protection......Page 85
  Trusted Quality of Service......Page 86
 Summary......Page 88
 Review Questions......Page 89
 Posture Validation Servers......Page 94
  Cisco Secure Access Control Server......Page 95
  NAC Framework Solution with External Policy Servers......Page 99
  Audit Servers......Page 101
  Policy Evaluation and Choosing a Posture Token......Page 102
 NAC Agentless Hosts and Whitelisting......Page 103
 Authorization......Page 104
 Enforcement Actions......Page 105
  Posture Plug-in Actions......Page 106
 Summary......Page 107
 Review Questions......Page 108
 IEEE 802.1X Technology Overview......Page 112
  Supplicant......Page 113
  Authenticator......Page 114
 IEEE 802.1X Operational Overview......Page 116
 RADIUS......Page 118
  EAP Negotiation......Page 121
  End-to-End EAP......Page 122
  Tunneled Method......Page 123
 Authorization and Enforcement......Page 124
  VLAN Assignment......Page 125
  Default Operation......Page 126
  The Guest-VLAN......Page 127
  IP Telephony......Page 128
  Management Utilities......Page 130
  Supplemental Authentication Techniques......Page 132
 NAC-L2-802.1X Identity with Posture Validation and Enforcement......Page 133
  NAC Supplicants for 802.1X......Page 134
  EAP-FAST......Page 135
  Accounting......Page 136
 Summary......Page 138
 Review Questions......Page 139
Chapter 6 NAC Layer 3 Operations......Page 144
  Posture Trigger Mechanisms for NAC-L3-IP and NAC-L2-IP......Page 145
  Session Initiation Process......Page 146
  Credential Validation......Page 147
  RADIUS......Page 148
  Cisco Trust Agent......Page 151
  Policy Enforcement......Page 152
 Voice Integration......Page 154
  Impact of Trust Agent Disappearing......Page 155
  Voice Integration Summary......Page 156
 Exceptions to NAC Posture......Page 157
 Summary......Page 158
 Review Questions......Page 159
 NAC Framework Lifecycle Process......Page 162
  Define Your Corporate Security Policy......Page 164
 Planning Phase......Page 168
  NAC Solution Objectives......Page 169
  Documenting Your Existing Infrastructure......Page 170
  Integration Strategy......Page 177
  Operational Strategy......Page 178
  Proof of Concept......Page 179
  Cost Considerations......Page 180
 Design Phase......Page 182
  Network Admission Policy Definition......Page 183
  Solution Scalability and High-Availability Considerations......Page 198
 Implementation Phase......Page 207
  Staging Implementation......Page 208
  Communication to Users......Page 214
 Operation and Optimization Phases......Page 215
 Summary......Page 216
 Review Questions......Page 217
 Policing Your Information Highway......Page 222
  Asset Protection......Page 224
  Detecting Misbehavior and Dealing with It......Page 226
 Value Is in the NAC Partners......Page 227
 Examples of Admission Control Uses......Page 228
  Enforcing Physical Identification for Higher Security Clearance......Page 229
  Enacting Roles-Based Provisioning......Page 230
  Using Customized Shared Resources......Page 231
 Summary......Page 232
Appendix A: Answers to Review Questions......Page 234
 A......Page 256
 D......Page 257
 E......Page 258
 N......Page 259
 P......Page 260
 T-U......Page 262
 V-W-X-Y-Z......Page 263