Guest

Cisco NAC Profiler

Cisco NAC Profiler Ordering Guide

  • Viewing Options

  • PDF (158.6 KB)
  • Feedback

This document describes the ordering guidelines for the Cisco® NAC Profiler product effective November 18, 2010.

What's New in This Guide?

This version of the guide incorporates the next-generation hardware for the Cisco NAC Appliance.

Next-Generation Appliances

Customers can use the next-generation appliances in combination with the existing appliances.

Cisco NAC Profiler Components

Cisco NAC Profiler contains two components: the Cisco NAC Profiler Server and the Cisco NAC Profiler Collector modules.
Cisco NAC Profiler provides the interface to create profiling rule sets. NAC Profiler manages, receives, and correlates information from NAC Profiler Collector, then provides external applications with access to the profiled device list. NAC Profiler Collector collects information about clientless devices and relays that information to the NAC Profiler Server.
As each Cisco NAC Profiler Collector gathers information from associated endpoints, the data from all the Collectors is combined and represented at the Profiler as a comprehensive list of information. This comprehensive list can be viewed within Cisco NAC Profiler or, in deployments with full Cisco NAC posture and remediation, through Cisco NAC Manager. Additionally, Cisco NAC Manager administrators can use the list created by NAC Profiler to provision the appropriate endpoint device type with the corresponding access privileges.

Deployment Options

There are two deployment choices for NAC Profiler Collectors:

• Deployment option 1: Deploy the Collectors on a Cisco NAC Server (to augment the existing posture and remediation service)

• Deployment option 2: Deploy as a standalone Collector (no posture or remediation service)

The Cisco NAC Profiler Server (NAC33XX-PROF-K9) enables profiling capability when installed on a Cisco NAC Appliance 3315 or 3355 system in either standalone or failover mode.
The Cisco NAC Profiler Collector (NAC33XX-CLT-K9=) enables collection capabilities on an existing NAC Server, and is used in full NAC deployments where NAC Manager and NAC Servers are providing posture and remediation.
The Cisco NAC Collector (NAC33XX-X000C-K9) enables collection capability only. It is used when customers are only interested in MAC Authentication Bypass (MAB), without posture or remediation. It can be installed on a Cisco NAC Appliance 3315 or 3355 system in standalone or failover mode.

About Failover Bundles

Cisco NAC Profiler components can be installed in standalone or failover mode on the Cisco NAC Appliance 3315 and 3355 hardware platforms.
Failover bundles are identified by an "FB" in the part number. The Cisco NAC Profiler Server or Collector failover bundle includes two discrete appliances. The failover mechanisms (link state and databases) will operate between each other, independent of the state of the Cisco NAC Server components.
In the case of the Cisco NAC Collector, a failover bundle must be selected if you have installed or are installing Cisco NAC Servers in failover or high-availability mode. In this scenario, the failover state of each NAC Server will determine the failover state of its corresponding Cisco NAC Collector.
A design will always include a Cisco NAC Profiler (with or without failover) and some number of Collectors. The Collector modules can be installed either on a NAC Server or as a standalone Collector.

Sizing the Deployment

Determining a design for the Cisco NAC Profiler is contingent on whether an existing or proposed full Cisco NAC solution is being considered. The following design rules should assist in determining what to order.

Design Rule 1

For NAC Profiler designs that will augment a full Cisco NAC solution, order one (1) Cisco NAC Profiler Collector license that matches the hardware platform of the Cisco NAC Appliance 3315 and 3355.
Table 1 lists the part numbers and descriptions of Cisco NAC Profiler Collector licenses along with their corresponding Cisco NAC Server part numbers for full NAC deployments.

Table 1. Part Numbers of Cisco NAC Profiler Collector Licenses to be Installed on NAC Servers as Part of a Full NAC Solution

Product Part Number

Product Description

Corresponding Cisco NAC Appliance (Clean Access Server) Part Numbers

NAC3315-CLT-K9=

Cisco NAC Profiler Collector License for Cisco NAC Appliance 3315

NAC3315-100-K9

NAC3315-250-K9

NAC3315-500-K9

NAC3315-CLT-FB-K9=

Cisco NAC Profiler Collector Failover License for Cisco NAC Appliance 3315

NAC3315-100FB-K9

NAC3315-250FB-K9

NAC3315-500FB-K9

NAC3355-CLT-K9=

Cisco NAC Profiler Collector License for Cisco NAC Appliance 3355

NAC3355-1500-K9

NAC3355-2500-K9

NAC3355-3500-K9

NAC3355-5000-K9

NAC3355-CLT-FB-K9=

Cisco NAC Profiler Collector Failover License for Cisco NAC Appliance 3355

NAC3355-1500FB-K9

NAC3355-2500FB-K9

NAC3355-3500FB-K9

NAC3355-5000FB-K9

Design Rule 2

For every Cisco NAC Manager provided in the Cisco NAC design, order one (1) Cisco NAC Profiler Server. Table 2 lists the part numbers and descriptions of the Cisco NAC Profiler Servers.

Table 2. Part Numbers of Cisco NAC Profiler Servers

Product Part Number

Product Description

NAC3355-PROF-K9

Cisco NAC Profiler Server-up to 40K devices

NAC3355-PROF-FB-K9

Cisco NAC Profiler Server Failover Bundle-up to 40K devices

NAC3315-PROF-K9

Cisco NAC Profiler Server-up to 5K devices

NAC3315-PROF-FB-K9

Cisco NAC Profiler Server Failover Bundle-up to 5K devices

Design Rule 3

The Cisco NAC Profiler solution (Profiler Server/Profiler Collector) can be deployed independent of the NAC Appliance Manager and NAC Server components. Customers that do not require a full NAC solution may still have the need for clientless endpoint discovery. This is a common requirement for customers implementing 802.1x in wired environments. In these designs there will be one or more NAC Profiler Servers receiving information from some number of NAC Collectors. Table 3 lists the part numbers and descriptions of Cisco NAC Collectors.

Table 3. Part Numbers of Cisco NAC Collectors

Product Part Number

Product Description

NAC3315-1000C-K9

NAC 3315 Collector-max 1000 devices

NAC3315-1000CFB-K9

NAC 3315 Collector Failover Bundle-max 1000 devices

NAC3355-3000C-K9

NAC 3355 Collector-max 3000 devices

NAC3355-3000CFB-K9

NAC 3355 Collector Failover Bundle-max 3000 devices

NAC3355-5000C-K9

NAC 3355 Collector-max 5000 devices

NAC3355-5000CFB-K9

NAC 3355 Collector Failover Bundle-max 5000 devices

NAC3355-7000C-K9

NAC 3355 Collector-max 7000 devices

NAC3355-7000CFB-K9

NAC 3355 Collector Failover Bundle-max 7000 devices

Product List Summary

Table 4 outlines the complete list of the Cisco NAC Profiler Server and Cisco NAC Collector part numbers.

Table 4. Cisco NAC Profiler Server and Cisco NAC Collector Part Numbers

Product Part Number

Product Description

NAC3355-PROF-K9

Cisco NAC Profiler Server-up to 40K devices

NAC3355-PROF-FB-K9

Cisco NAC Profiler Server Failover Bundle-up to 40K devices

NAC3315-PROF-K9

Cisco NAC Profiler Server-up to 5K devices

NAC3315-PROF-FB-K9

Cisco NAC Profiler Server Failover Bundle-up to 5K devices

NAC3355-CLT-K9=

Cisco NAC Profiler Collector License for Cisco NAC Appliance 3355

NAC3355-CLT-FB-K9=

Cisco NAC Profiler Collector Failover License for Cisco NAC Appliance 3355

NAC3315-CLT-K9=

Cisco NAC Profiler Collector License for Cisco NAC Appliance 3315

NAC3315-CLT-FB-K9=

Cisco NAC Profiler Collector Failover License for Cisco NAC Appliance 3315

NAC3315-1000C-K9

Cisco NAC 3315 Collector-max 1000 devices

NAC3315-1000CFB-K9

Cisco NAC 3315 Collector Failover Bundle-max 1000 devices

NAC3355-3000C-K9

Cisco NAC 3355 Collector-max 3000 devices

NAC3355-3000CFB-K9

Cisco NAC 3355 Collector Failover Bundle-max 3000 devices

NAC3355-5000C-K9

Cisco NAC 3355 Collector-max 5000 devices

NAC3355-5000CFB-K9

Cisco NAC 3355 Collector Failover Bundle-max 5000 devices

NAC3355-7000C-K9

Cisco NAC 3355 Collector-max 7000 devices

NAC3355-7000CFB-K9

Cisco NAC 3355 Collector Failover Bundle-max 7000 devices

NAC3355-3000UL

Cisco NAC 3355 Collector License Upgrade-3000 to 5000 devices

NAC3355-3000FBUL

Cisco NAC 3355 Collector Failover Bundle License Upgrade-3000 to 5000 devices

NAC3355-5000UL

Cisco NAC 3355 Collector License Upgrade-5000 to 7000 devices

NAC3355-5000FBUL

Cisco NAC 3355 Collector Failover Bundle License Upgrade-5000 to 7000 devices

Part Numbers for Support

Four types of Cisco SMARTnet ® support services are available for Cisco NAC customers:

8x5xNBD: Next business day (order must be received before cutoff time)

8x5x4: Standard 4-hour service

24x7x4: Premium 4-hour service

24x7x2: Premium 2-hour service

For more information about Cisco SMARTnet service offerings, please visit http://www.cisco.com/en/US/products/svcs/ps3034/ps2827/ps2978/serv_group_home.html.
Table 5 outlines the support part numbers for the Cisco NAC Profiler.

Table 5. Cisco NAC Profiler Support Part Numbers

Product Part Number

Support Description

For Cisco NAC Profiler, without Failover

CON-S2P-NPROFK9

SMARTnet 24X7X2 NAC3315-PROF-K9

CON-SNT-NPROFK9

SMARTnet 8X5XNBD NAC3315-PROF-K9

CON-SNTE-NPROFK9

SMARTnet 8X5X4 NAC3315-PROF-K9

CON-SNTP-NPROFK9

SMARTnet 24X7X4 NAC3315-PROF-K9

CON-SNT-N3355PK9

SMARTnet 8x5xNBD Service for NAC3355-PROF-K9

CON-SNTE-N3355PK9

SMARTnet 8x5x4 Service for NAC3355-PROF-K9

CON-SNTP-N3355PK9

SMARTnet 24x7x4 Service for NAC3355-PROF-K9

CON-S2P-N3355PK9

SMARTnet 24x7x2 Service for NAC3355-PROF-K9

CON-OS-N3355PK9

SMARTnet 8x5xNBD Onsite Service for NAC3355-PROF-K9

CON-OSE-N3355PK9

SMARTnet 8x5x4 Onsite Service for NAC3355-PROF-K9

CON-OSP-N3355PK9

SMARTnet 24x7x4 Onsite Service for NAC3355-PROF-K9

CON-PREM-N3355PK9

SMARTnet 24x7x2 Onsite Service for NAC3355-PROF-K9

For Cisco NAC Profiler, with Failover

CON-S2P-N3315PFB

SMARTnet 24X7X2 NAC3315-PROF-FB-K9

CON-SNT-N3315PFB

SMARTnet 8X5XNBD NAC3315-PROF-FB-K9

CON-SNTE-N3315PFB

SMARTnet 8X5X4 NAC3315-PROF-FB-K9

CON-SNTP-N3315PFB

SMARTnet 24X7X4 NAC3315-PROF-FB-K9

CON-SNT-NACP55F

SMARTnet 8x5xNBD Service for NAC3355-PROF-FB-K9

CON-SNTE-NACP55F

SMARTnet 8x5x4 Service for NAC3355-PROF-FB-K9

CON-SNTP-NACP55F

SMARTnet 24x7x4 Service for NAC3355-PROF-FB-K9

CON-S2P-NACP55F

SMARTnet 24x7x2 Service for NAC3355-PROF-FB-K9

CON-OS-NACP55F

SMARTnet 8x5xNBD Onsite Service for NAC3355-PROF-FB-K9

CON-OSE-NACP55F

SMARTnet 8x5x4 Onsite Service for NAC3355-PROF-FB-K9

CON-OSP-NACP55F

SMARTnet 24x7x4 Onsite Service for NAC3355-PROF-FB-K9

CON-PREM-NACP55F

SMARTnet 24x7x2 Onsite Service for NAC3355-PROF-FB-K9

Table 6 outlines the support part numbers for the Cisco NAC Profiler Collector.

Table 6. Cisco NAC Profiler Collector Support Part Numbers

Product Part Number

Support Description

For Cisco NAC Profiler Collectors on the NAC Appliance 3315, without Failover

CON-SNT-CLTK9315

SMARTnet 8x5xNBD Service for NAC3315-CLT-K9=

CON-SNTE-CLTK9315

SMARTnet 8x5x4 Service for NAC3315-CLT-K9=

CON-SNTP-CLTK9315

SMARTnet 24x7x4 Service for NAC3315-CLT-K9=

CON-S2P- CLTK9315

SMARTnet 24x7x2 Service for NAC3315-CLT-K9=

CON-OS- CLTK9315

SMARTnet 8x5xNBD Onsite Service for NAC3315-CLT-K9=

CON-OSE- CLTK9315

SMARTnet 8x5x4 Onsite Service for NAC3315-CLT-K9=

CON-OSP- CLTK9315

SMARTnet 24x7x4 Onsite Service for NAC3315-CLT-K9=

CON-PREM- CLTK9315

SMARTnet 24x7x2 Onsite Service for NAC3315-CLT-K9=

For Cisco NAC Profiler Collectors on the NAC Appliance 3315, with Failover

CON-SNT-CLTFBK93

SMARTnet 8x5xNBD Service for NAC3315-CLT-FB-K9=

CON-SNTE- CLTFBK93

SMARTnet 8x5x4 Service for NAC3315-CLT-FB-K9=

CON-SNTP- CLTFBK93

SMARTnet 24x7x4 Service for NAC3315-CLT-FB-K9=

CON-S2P- CLTFBK93

SMARTnet 24x7x2 Service for NAC3315-CLT-FB-K9=

CON-OS- CLTFBK93

SMARTnet 8x5xNBD Onsite Service for NAC3315-CLT-FB-K9=

CON-OSE- CLTFBK93

SMARTnet 8x5x4 Onsite Service for NAC3315-CLT-FB-K9=

CON-OSP- CLTFBK93

SMARTnet 24x7x4 Onsite Service for NAC3315-CLT-FB-K9=

CON-PREM- CLTFBK93

SMARTnet 24x7x2 Onsite Service for NAC3315-CLT-FB-K9=

For Cisco NAC Profiler Collectors on the NAC Appliance 3355, without Failover

CON-SNT-CLTK9355

SMARTnet 8x5xNBD Service for NAC3355-CLT-K9=

CON-SNTE-CLTK9355

SMARTnet 8x5x4 Service for NAC3355-CLT-K9=

CON-SNTP-CLTK9355

SMARTnet 24x7x4 Service for NAC3355-CLT-K9=

CON-S2P-CLTK9355

SMARTnet 24x7x2 Service for NAC3355-CLT-K9=

CON-OS-CLTK9355

SMARTnet 8x5xNBD Onsite Service for NAC3355-CLT-K9=

CON-OSE-CLTK9355

SMARTnet 8x5x4 Onsite Service for NAC3355-CLT-K9=

CON-OSP-CLTK9355

SMARTnet 24x7x4 Onsite Service for NAC3355-CLT-K9=

CON-PREM-CLTK9355

SMARTnet 24x7x2 Onsite Service for NAC3355-CLT-K9=

For Cisco NAC Profiler Collectors on the NAC Appliance 3355, with Failover

CON-SNT-NCLTFBK9

SMARTnet 8x5xNBD Service for NAC3355-CLT-FB-K9=

CON-SNTE- NCLTFBK9

SMARTnet 8x5x4 Service for NAC3355-CLT-FB-K9=

CON-SNTP- NCLTFBK9

SMARTnet 24x7x4 Service for NAC3355-CLT-FB-K9=

CON-S2P- NCLTFBK9

SMARTnet 24x7x2 Service for NAC3355-CLT-FB-K9=

CON-OS- NCLTFBK9

SMARTnet 8x5xNBD Onsite Service for NAC3355-CLT-FB-K9=

CON-OSE- NCLTFBK9

SMARTnet 8x5x4 Onsite Service for NAC3355-CLT-FB-K9=

CON-OSP- NCLTFBK9

SMARTnet 24x7x4 Onsite Service for NAC3355-CLT-FB-K9=

CON-PREM- NCLTFBK9

SMARTnet 24x7x2 Onsite Service for NAC3355-CLT-FB-K9=

For Cisco NAC Collector on the NAC Appliance 3315, without Failover

CON-S2P-1000CK9

SMARTnet 24X7X2 NAC3315-1000C-K9

CON-SNT-1000CK9

SMARTnet 8X5XNBD NAC3315-1000C-K9

CON-SNTE-1000CK9

SMARTnet 8X5X4 NAC3315-1000C-K9

CON-SNTP-1000CK9

SMARTnet 24X7X4 NAC3315-1000C-K9

For Cisco NAC Collector on the NAC Appliance 3315, with Failover

CON-S2P-1000CFBK

SMARTnet 24X7X2 NAC3315-1000CFB-K9

CON-SNT-1000CFBK

SMARTnet 8X5XNBD NAC3315-1000CFB-K9

CON-SNTE-1000CFBK

SMARTnet 8X5X4 NAC3315-1000CFB-K9

CON-SNTP-1000CFBK

SMARTnet 24X7X4 NAC3315-1000CFB-K9

For Cisco NAC Collector on the NAC Appliance 3355, without Failover

CON-S2P-3000CK9

SMARTnet 24X7X2 NAC3355-3000C-K9

CON-SNT-3000CK9

SMARTnet 8X5XNBD NAC3355-3000C-K9

CON-SNTE-3000CK9

SMARTnet 8X5X4 NAC3355-3000C-K9

CON-SNTP-3000CK9

SMARTnet 24X7X4 NAC3355-3000C-K9

CON-S2P-5000CK9

SMARTnet 24X7X2 NAC3355-5000C-K9

CON-SNT-5000CK9

SMARTnet 8X5XNBD NAC3355-5000C-K9

CON-SNTE-5000CK9

SMARTnet 8X5X4 NAC3355-5000C-K9

CON-SNTP-5000CK9

SMARTnet 24X7X4 NAC3355-5000C-K9

CON-S2P-7000CK9

SMARTnet 24X7X2 NAC3355-7000C-K9

CON-SNT-7000CK9

SMARTnet 8X5XNBD NAC3355-7000C-K9

CON-SNTE-7000CK9

SMARTnet 8X5X4 NAC3355-7000C-K9

CON-SNTP-7000CK9

SMARTnet 24X7X4 NAC3355-7000C-K9

For Cisco NAC Collector on the NAC Appliance 3355, with Failover

CON-S2P-3KCFBK9

SMARTnet 24X7X2 NAC3355-3000CFB-K9

CON-SNT-3KCFBK9

SMARTnet 8X5XNBD NAC3355-3000CFB-K9

CON-SNTE-3KCFBK9

SMARTnet 8X5X4 NAC3355-3000CFB-K9

CON-SNTP-3KCFBK9

SMARTnet 24X7X4 NAC3355-3000CFB-K9

CON-S2P-5KCFBK9

SMARTnet 24X7X2 NAC3355-5000CFB-K9

CON-SNT-55KCFBK9

SMARTnet 8X5XNBD NAC3355-5000CFB-K9

CON-SNTE-5KCFBK9

SMARTnet 8X5X4 NAC3355-5000CFB-K9

CON-SNTP-5KCFBK9

SMARTnet 24X7X4 NAC3355-5000CFB-K9

CON-S2P-N7KCFBK9

SMARTnet 24X7X2 NAC3355-7000CFB-K9

CON-SNT-7KCFBK9

SMARTnet 8X5XNBD NAC3355-7000CFB-K9

CON-SNTE-7KCFBK9

SMARTnet 8X5X4 NAC3355-7000CFB-K9

CON-SNTP-7KCFBK9

SMARTnet 24X7X4 NAC3355-7000CFB-K9

For Cisco NAC Collector Non-Failover Upgrade Licenses

CON-S2P-553000UL

SMARTnet 24X7X2 NAC3355-3000UL

CON-SNT-553000UL

SMARTnet 8X5XNBD NAC3355-3000UL

CON-SNTE-553000UL

SMARTnet 8X5X4 NAC3355-3000UL

CON-SNTP-553000UL

SMARTnet 24X7X4 NAC3355-3000UL

CON-S2P-5000UL

SMARTnet 24X7X2 NAC3355-5000UL

CON-SNT-5000UL

SMARTnet 8X5XNBD NAC3355-5000UL

CON-SNTE-5000UL

SMARTnet 8X5X4 NAC3355-5000UL

CON-SNTP-5000UL

SMARTnet 24X7X4 NAC3355-5000UL

For Cisco NAC Collector Failover Upgrade Licenses

CON-S2P-3000FBUL

SMARTnet 24X7X2 NAC3355-3000FBUL

CON-SNT-3000FBUL

SMARTnet 8X5XNBD NAC3355-3000FBUL

CON-SNTE-3000FBUL

SMARTnet 8X5X4 NAC3355-3000FBUL

CON-SNTP-3000FBUL

SMARTnet 24X7X4 NAC3355-3000FBUL

CON-S2P-5000FBUL

SMARTnet 24X7X2 NAC3355-5000FBUL

CON-SNT-5000FBUL

SMARTnet 8X5XNBD NAC3355-5000FBUL

CON-SNTE-5000FBUL

SMARTnet 8X5X4 NAC3355-5000FBUL

CON-SNTP-5000FBUL

SMARTnet 24X7X4 NAC3355-5000FBUL

Compatibility with Existing Cisco NAC Installations

If the Cisco NAC Appliance is already deployed, it is critical to verify that each NAC Server has enough Ethernet ports to accommodate the Cisco NAC Collector module requirements.

Frequently Asked Questions

Q. How does the Cisco NAC Profiler Server communicate endpoint information to the Cisco NAC Appliance Manager?
A. The Cisco NAC Profiler Server communicates endpoint information to the Cisco NAC Appliance Manager using the NAC Appliance API.
Q. How does the Cisco NAC Profiler determine the endpoints' identities?
A. The Cisco NAC Profiler uses several discovery techniques, including passive and active mechanisms such as Simple Network Management Protocol (SNMP), network traffic analysis, NetFlow data, and active profiling. Data from these discovery mechanisms is aggregated to provide a comprehensive, real-time view of all network-attached endpoints.
Q. Is the Cisco NAC Profiler inline?
A. No. Instead, the Cisco NAC Profiler Collector uses several discovery techniques, including SNMP, traffic analysis via SPAN, and NetFlow data.
Q. Can I deploy the Cisco NAC Profiler in in-band and out-of-band NAC Appliance deployments?
A. Yes. Cisco NAC Profiler works in either in-band or out-of-band NAC Appliance deployments.
Q. What is the maximum number of endpoints that the Cisco NAC Profiler can manage in a single database?
A. The number of endpoints that Cisco NAC Profiler supports is tied to the Cisco NAC Appliance deployment. Customers should order one Cisco NAC Profiler Server for each Cisco NAC Manager, and one Cisco NAC Profiler Collector license for each Cisco NAC Server they have deployed. Alternatively, in a Profiler deployment without other NAC components, the database size is listed in the ordering description.
Q. Can the Cisco NAC Profiler Collector license be deployed independent of the posture capabilities of the Cisco NAC Appliance Server? If so, how would it be ordered?
A. Both components of the Cisco NAC Profiler are intended to be used in support of Cisco NAC implementations. However, if customers want to begin with profiling only, without user posture, the Cisco NAC Profiler Collector license description details the device count support.
Q. My customer has already deployed Profiler and Collectors in their environment and now wishes to upgrade the Collectors to full NAC Servers to perform posture and remediation. How is this done?
A. There is no upgrade path for NAC Collectors to be converted to joint NAC Server/Collector deployments.
Q. Does the Cisco Profiler Collector support the NAC-NME modules?
A. No.
Q. How should I count endpoints for Profiler sizing and licensing?
A. Every MAC address discovered is counted, whether it is placed into a profile or not.
Q. Can the Profiler Server be integrated with more than one NAC Appliance Manager?
A. No. Only one NAC Profiler can be integrated with a NAC Appliance Manager and vice versa.

For More Information

For more information about the Cisco NAC Profiler or Cisco NAC, visit http://www.cisco.com/go/nac/appliance or contact your local account representative. Inquiries on ordering or deployment sizing can also be e-mailed to cca-questions@external.cisco.com.