Network Admission Control Agentless Host Support

The Cisco Network Admission Control functionality enables the credentials of the endpoint device to be checked for compliance with the security policy before the device is granted access to network resources. This checking requires a security application called Cisco Trust Agent (CTA) to be installed on end devices that gather security state information and communicate it to access servers where policy decisions are made and eventually enforced on Cisco network access devices (such as routers and switches).

End devices that do not run CTA cannot provide credentials when challenged by network access devices (NADs). Such hosts are termed “agentless” or “nonresponsive.” In the Phase l release of Network Admission Control, agentless hosts were supported by either a static configuration using exception lists (an identity profile) or by using “clientless” username and password authentication on an ACS. These methods are restrictive and do not convey any specific information about the host while making policy decisions.

You can use the EAPoUDP Bypass feature to reduce latency of the validation of hosts that are not using CTA. If EAPoUDP bypass is enabled, the NAD does not contact the host to request the antivirus condition (the NAD does not try to establish an EAPoUDP association with the host if the EAPoUDP Bypass option is configured). Instead, the NAD sends a request to the Cisco Secure ACS that includes the IP address, MAC address, service type, and EAPoUDP session ID of the host. The Cisco Secure ACS makes the access control decision and sends the policy to the NAD.

If EAPoUDP bypass is enabled, the NAD sends an agentless host request to the Cisco Secure ACS and applies the access policy from the server to the host.

If EAPoUDP bypass is enabled and the host uses the Cisco Trust Agent, the NAD also sends a nonresponsive-host request to the Cisco Secure ACS and applies the access policy from the server to the host.

The following new attributes are supported for various RADIUS message exchanges:

• audit-session-id
  
• url-redirect-acl
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip admission name admission-name eapoudp bypass

4.    eou allow clientless

5.    interface type slot / port

6.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip admission name admission-name eapoudp bypass Example: Router (config)# ip admission name greentree eapoudp bypass	The IP network admission control rule bypasses EAPoUDP communication.
Step 4	eou allow clientless Example: Router (config)# eou allow clientless	Allows authentication of clientless hosts (systems that do not run Cisco Trust Agent).
Step 5	interface type slot / port Example: Router (config)# interface ethernet 2/4	Configures an interface type and enters interface configuration mode.
Step 6	end Example: Router (config-if)# end	Exits configuration modes.

SUMMARY STEPS

1.    enable

2.    debug eou

3.    show eou ip ip-address

4.    show ip admission configuration

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	debug eou Example: Router# debug eou	Displays information about EAUoUDP.
Step 3	show eou ip ip-address Example: Router# show eou ip 10.0.0.0	Displays information about EAPoUDP global values or EAPoUDP session cache entries.
Step 4	show ip admission configuration Example: Router# show ip admission configuration	Displays information about the agentless and EAPoUDP Bypass configuration.

The following show eou command output displays EAPoUPD session cache information for a given IP address. The value of the newly defined VSA is also shown.

Router# show eou ip 10.0.0.1
Address             : 10.0.0.1
MAC Address         : 0001.027c.f364
Interface           : FastEthernet1/0/3
AuthType            : EAP
Audit Session ID    : 000000001C8A6A330000001812000001
PostureToken        : Infected
Age(min)            : 444
URL Redirect        : http://wwwin.cisco.com 
URL Redirect ACL    : RedirectACL
ACL Name            : #ACSACL#-IP-Infected-42835ff7
User Name           : NAC-DEV-PC-3:Administrator
Revalidation Period : 30000 Seconds
Status Query Period : 300 Seconds
Current State       : AUTHENTICATED