Network Admission Control Network Modules

Table Of Contents

Connecting Cisco Network Admission Control Network Modules to the Network

Cisco NAC Network Modules

Shutting Down the NAC Network Module

Connecting NAC Network Modules

Establishing a Gigabit Ethernet Internal Logical Connection

Online Insertion and Removal of Cisco NAC Network Modules

Related Documents

Obtaining Documentation, Obtaining Support, and Security Guidelines

Connecting Cisco Network Admission Control Network Modules to the Network

---

Revised: May 1, 2008, OL-16674-01

This guide describes how to connect Cisco Network Admission Control (NAC) network modules to your network. It contains the following sections:

•Cisco NAC Network Modules

•Connecting NAC Network Modules

•Online Insertion and Removal of Cisco NAC Network Modules

•Related Documents

•Obtaining Documentation, Obtaining Support, and Security Guidelines

Cisco NAC Network Modules

Cisco NAC network modules allow network administrators to authenticate, authorize, evaluate, and remediate wired, wireless, and remote users and their machines before allowing users onto a network. The NAC module identifies whether networked devices, such as laptops, desktops, and corporate assets are compliant with a network's security policies, and it addresses vulnerabilities before permitting access to the network.

The Cisco NAC network module ships from the factory with the following hardware preinstalled.

---

Note See the Cisco NAC network module data sheet for supported Cisco Internet Operating System (IOS) version information, http://www.cisco.com/en/US/products/ps6128/products_data_sheets_list.html.

---

Model	Hard Disk	Memory	CompactFlash
NME-NAC-K9	80 GB	512 MB	64 MB

The Cisco NAC network module LEDs are shown in Figure 1 and described in Table 1.

Figure 1 NME-NAC-K9 Faceplate

Table 1

CF	Status of the CompactFlash Off—CompactFlash is not detected Flashing—Application detected CompactFlash at bootup
LINK	Status of Gigabit Ethernet link On—Link is enabled Off—Link is disabled
ACT	Status of Gigabit Ethernet activity On—Active Off—Inactive
DISK	Status of hard drive activity On—Active Off—Inactive
PWR/SYS	Status of system shutdown Note Do not remove power without first shutting down the application. See the "Shutting Down the NAC Network Module" section. On—Application is stable Off—System is shut down and ready for host power down Flashing—System shutdown is in progress
EN	Status of the network module On—Detected by the host Cisco IOS software and enabled Off—Disabled

NME-NAC-K9 LED Descriptions

Shutting Down the NAC Network Module

Press the shutdown button on the network module faceplate for less than 2 seconds to perform a graceful shutdown of the hard disk before removing power from the router or before starting an online insertion and removal (OIR) sequence on the router. The application may take up to 2 minutes to fully shut down.

---

Note See the Getting Started with NAC Network Modules in Cisco Access Routers document on Cisco.com for instructions that describe how to shut down the network module from the command line interface on the router, http://www.cisco.com/en/US/products/ps6128/prod_installation_guides_list.html

---

---

Caution If you press the shutdown button for more than 4 seconds, a non-graceful shutdown of the hard disk will occur and may cause file corruption on the network module's hard disk. After a non-graceful shutdown, the DISK and SYS LEDs remain lighted. Press the shutdown button for less than 1 second to gracefully reboot the network module.

---

Connecting NAC Network Modules

To connect Cisco NAC network modules to an external device use a straight-through two-pair Category 5 unshielded twisted-pair (UTP) cable and connect the RJ-45 Gigabit Ethernet port on the network module to a switch, hub, repeater, or other Gigabit Ethernet network device.

---

Warning To comply with the Telcordia GR-1089 NEBS standard for electromagnetic compatibility and safety, connect the Network Admission Control Network Modules (NME-NAC-K9) only to intra-building or unexposed wiring or cable. The intrabuilding cable must be shielded and the shield must be grounded at both ends. The intra-building port(s) of the equipment or subassembly must not be metallically connected to interfaces that connect to the OSP or its wiring. These interfaces are designed for use as intra-building interfaces only (Type 2 or Type 4 ports as described in GR-1089-CORE, Issue 4) and require isolation from the exposed OSP cabling. The addition of Primary Protectors is not sufficient protection in order to connect these interfaces metallically to OSP wiring.

---

---

Warning To comply with the Telcordia GR-1089 NEBS standard for electromagnetic compatibility and safety, connect the NAM enhanced network module (NME-NAM-80S) only to intra-building or non-exposed wiring or cabling. The intrabuilding cable must be shielded and the shield must be grounded at both ends. The intra-building port(s) of the equipment or subassembly must not be metallically connected to interfaces that connect to the OSP or its wiring. These interfaces are designed for use as intra-building interfaces only (Type 2 or Type 4 ports as described in GR-1089-CORE, Issue 4) and require isolation from the exposed OSP cabling. The addition of Primary Protectors is not sufficient protection in order to connect these interfaces metallically to OSP wiring.

---

---

Note RJ-45 cables are not available from Cisco Systems. These cables are widely available and must be Category 5 cables.

---

Establishing a Gigabit Ethernet Internal Logical Connection

Use the Cisco High-Speed Intrachassis Module Interconnect (HIMI) feature to establish a Gigabit Ethernet (GE) internal logical connection between two NMEs, or between an onboard small-form-factor pluggable (SFP) GE module and an NME on Cisco 3825 and Cisco 3845 routers.

Connections can be established only as follows:

•Between the GE port in an installed onboard SFP module on the Cisco 3825 and Cisco 3845 routers

•Between GE interfaces in NME slots 1 and 2 on the Cisco 3825 router

•Between GE interfaces in NME slots 2 and 4 on the Cisco 3845 router

---

Note A module interconnection between the GE port on an SFP module and an NME slot or an NME-to-NME cross-connection is permitted at any given time, but both types of connections cannot exist at the same time.

---

---

Note Connections between the onboard RJ-45 GE ports and NME slots are not supported.

---

For details about configuring HIMI connections, see the Cisco High-Speed Intrachassis Module Interconnect (HIMI) Configuration Guide on Cisco.com, http://www.cisco.com/en/US/products/ps5855/prod_configuration_guide09186a008068ea83.html

Online Insertion and Removal of Cisco NAC Network Modules

Some Cisco access routers allow you to replace network modules without switching off the router or affecting the operation of other interfaces. This feature is called online insertion and removal (OIR). Module OIR provides uninterrupted operation to network users, maintains routing information, and ensures session preservation.

---

Caution Unlike other network modules, the Cisco NAC network module uses a hard disk. Online removal of disks without proper shutdown can result in file system corruption and might render the disk unusable. The operating system on the network module must be shut down in an orderly fashion before the module is removed or powered down.

---

---

Caution Cisco routers support OIR with similar modules only. If you remove a module, install another module exactly like it in its place. If you remove a 2-slot module (along with any installed WAN or voice interface cards), install another module and card combination exactly like it.

---

For a description of informational and error messages that may appear on the console during this procedure, see the hardware installation guide for your router.

To perform online removal of a network module and insertion of a replacement, follow these steps, beginning in privileged EXEC mode:

---

Step 1 Initiate a network module session using the following command:

Router# service-module integrated-service-engine 1/0 session

Trying 10.10.10.1, 2065 ... Open

Press RETURN to get started!

Router> enable

Router#

Step 2 Save the running configuration of the network module by using the following command from the
router # prompt:

Router# copy running-config tftp tftp-server-address filename

Step 3 Exit the network module session by pressing Control-Shift-6, followed by x.

Step 4 On the router, clear the integrated-service-engine console session by using the following command:

Router# service-module integrated-service-engine slot/unit session clear

Step 5 Perform a graceful shutdown of the network module disk drive by using the following command:

Router# service-module integrated-service-engine slot/unit shutdown 

Step 6 Shut down the network module interface:

Router (config)# interface integrated-service-engine slot/unit

Router (config-if)# shutdown

Router (config-if)# exit

Step 7 Unplug all network interface cables from the network module.

Step 8 Loosen the two captive screws holding the network module in the chassis slot.

Step 9 Slide the network module out of the slot.

Step 10 Align the replacement network module with the guides in the chassis slot, and slide it gently into the slot.

---

Note If the router is not fully configured with network modules, make sure that blank panels fill the unoccupied chassis slots to provide proper airflow.

---

Step 11 Push the module into place until you feel its edge connector mate securely with the connector on the backplane.

Step 12 Reconnect the network interface cables that you disconnected in Step 7.

Step 13 Check that the network module LEDs are on and that the power (PWR) and enable (EN) LEDs on the front panel are also on. This inspection ensures that connections are secure and that the new unit is operational.

Step 14 Initiate a network module session with the following command:

Router# service-module integrated-service-engine slot/unit session

Trying 11.1.1.8, 2130 ... Open

Fedora Core release 4 (stentz)

Kernel 2.6.11-perfigo on an 1686

login:

Step 15 Exit the network module session by pressing Control-Shift-6, followed by x.

Step 16 Restore the network module running configuration by using the following command from the service module prompt:

Router# copy tftp running-config tftp-server-address filename

Step 17 On the router, clear the network module session by using the following command:

Router# service-module integrated-service-engine slot/unit session clear

---

Related Documents

For additional information, see the following documents and resources.

Related Topic	Document Title
Cisco Network Admission Control (NAC) software configuration	Cisco NAC Appliance http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html
Regulatory compliance and safety information	Cisco Network Modules and Interface Cards Regulatory Compliance and Safety Information http://www.cisco.com/en/US/docs/routers/access/interfaces/rcsi/IOHrcsi.html
Cisco IOS software website and reference documentation	Cisco IOS Software http://www.cisco.com/web/psa/products/index.html?c=268438303

Obtaining Documentation, Obtaining Support, and Security Guidelines

For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

---

CCDE, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0812R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2008 Cisco Systems, Inc. All rights reserved.