Downloads |
This document describes the ordering guidelines for the Cisco® NAC Appliance product (formerly Cisco Clean Access), effective September 10, 2007.
What's New in This Guide?
This version of the guide incorporates the latest form factor for the Cisco NAC Appliance: the Cisco NAC Network Module. In addition to offering the Cisco NAC Appliance components as discrete appliances, customers can now order the Cisco Clean Access Server as a network module that fits into the Cisco Series 2800 and 3800 Integrated Services Routers.
New Network Module
The Cisco® NAC Network Module for Integrated Services Routers brings the feature-rich Cisco Clean Access Server capabilities to Cisco 2800 and 3800 Series Integrated Services Routers. By extending the Cisco NAC Appliance portfolio of products to smaller locations, the Cisco NAC Network Module allows network administrators to manage a single device in the branch office for data, voice, and security requirements.
For more information about the Cisco NAC Network Module, please read the datasheet available at http://www.cisco.com/go/NACNM.
Customers can use the Cisco NAC Network Module in combination with the existing, appliance-based Cisco Clean Access Servers and Clean Access Managers. The following table outlines the additional options customers have.
Table 1. Cisco NAC Appliance Options
Cisco NAC Hardware Platforms
The Cisco NAC Appliance runs on the Cisco NAC Appliance 3300 Series hardware. Each hardware platform in the series supports several license requirements. Table 2 maps the licenses to the corresponding hardware.
Table 2. Mapping of Cisco NAC Appliance 3300 Series to Licenses
Sizing the Deployment
The number of online, concurrent users in a deployment determines the type and quantity of Cisco Clean Access Servers required. In turn, the type and quantity of Cisco Clean Access Servers determines the type of Cisco Clean Access Manager required. Figure 1 explains the selection process for the Cisco Clean Access Manager.
Figure 1. Cisco Clean Access Manager Selection Process
About Failover Bundles
Failover bundles are denoted by the "FB" in each part number. Customers that purchase a failover bundle will receive two appliances and a failover license that counts both appliances as one redundant unit. Failover bundles are not available for the Cisco NAC Network Module.
When sizing the Cisco Clean Access Manager, it is useful to note that one Cisco Clean Access Server failover bundle counts as one server toward the capacity of the manager. Thus, a Cisco Clean Access Super Manager can manage up to 40 Cisco Clean Access Server failover bundles.
Sample Scenarios
The following scenarios illustrate two typical deployments of the Cisco NAC Appliance.
Scenario 1
Customer has one headquarters location with 300 users and two remote sites with fewer than 50 users at each site. Customer prefers a central deployment, using Layer 3 in-band capability to consolidate the remote sites.
|
Management |
1 Cisco Clean Access Lite Manager with failover |
NACMGR-3FB-K9 |
|
Headquarters |
1 Cisco Clean Access Server with failover for 500 users |
NAC3310-500FB-K9 |
Scenario 2
Customer has one headquarters location with 500 users. Customer would like to provide wireless guest access for its conference rooms (estimated number of users as high as 200) and enforce security policies on employee wired access in an out-of-band deployment. Based on these requirements, a central deployment is recommended, with one Cisco Clean Access Server with failover for wireless users, and another for wired users.
Scenario 3
Customer has one headquarters location with 4500 users and ten branch offices with 50 users each. Customer would like to provide posture assessment for all employees. Based on these requirements, a central deployment is recommended.
Part Numbers for Appliances
Tables 3 and 4 list the part numbers for Cisco Clean Access Server and Cisco Clean Access Manager.
Table 3. Part Numbers for Cisco Clean Access Server
Table 4. Part Numbers for Cisco Clean Access Manager
Part Numbers for Cisco NAC Network Module
Table 5 lists the part numbers associated with the Cisco NAC Network Module.
Table 5. Part Numbers for Cisco NAC Network Module for Integrated Services Routers
When configuring a Cisco 2800 or 3800 Integrated Services Router chassis or bundle, select part number NME-NAC-K9 as an option within Network Modules. After confirming the software version for the NAC network module, select between the two Cisco NAC Network Module Server Licenses: part number NACNM-50-K9 or NACNM-100-K9.
If you initially purchase the 50-user license (NACNM-50-K9) for the NAC network module, you can upgrade to the 100-user license later by ordering part number NACNM-50UL=. You can select the license part numbers and apply them to the module spare (NME-NAC-K9=) in a similar manner. Licensing information is available at http://www.cisco.com/en/US/products/ps6128/prod_pre_installation_guide09186a008073136b.html
License and Hardware Upgrades for Appliances
Because of the different hardware models in the Cisco NAC Appliance 3300 Series, all license upgrades for the Cisco Clean Access Manager, and some for the Cisco Clean Access Server, require participation in the Cisco Technology Migration Program (TMP) in order to upgrade the hardware. Table 6 lists the product part numbers that require hardware upgrades.
Table 6. Cisco NAC Appliance Products Requiring Hardware Upgrades
In the case of some Cisco Clean Access Server licenses, customers may upgrade to a larger user license by purchasing a software upgrade license. Table 7 lists the product part numbers that do not require a hardware upgrade, along with their appropriate software upgrade license product number.
Table 7. Cisco NAC Appliance Products Eligible for Software Upgrade Licenses
Part Numbers for Support
Four types of Cisco SMARTnet support services are available for Cisco NAC Appliance customers:
• 8x5xNBD: Next business day (order received before cutoff time)
• 8x5x4: Standard 4-hour service
• 24x7x4: Premium 4-hour service
• 24x7x2: Premium 2-hour service
For more information about Cisco SMARTnet service offerings, please visit http://www.cisco.com/en/US/products/svcs/ps3034/ps2827/ps2978/serv_group_home.html.
Support for Cisco Clean Access Servers and Cisco Clean Access Managers is sold separately, while support for the Cisco NAC Network Module is included in SMARTNet for the Integrated Services Router.
Table 8 lists the part numbers of the four service options available for the Cisco Clean Access Server. Table 9 lists the part numbers of the four service options available for the Cisco Clean Access Manager. Table 10 lists the part numbers for upgrade licenses for the Clean Access Servers.
Table 8. Cisco Clean Access Server Support Part Numbers
Table 9. Cisco Clean Access Manager Support Part Numbers
Table 10. Upgrade License Support Part Numbers
Q&A
Q. Can one Cisco Clean Access Manager manage a deployment containing both Cisco Clean Access Servers and Cisco NAC Network Modules?
A. Yes. One Cisco Clean Access Manager can manage deployments with both appliance- and network module-based Clean Access Servers.
Q. Does the Cisco NAC Network Module have the same functionality as a Clean Access Server?
Yes. The Cisco NAC Network Module has exactly the same functionality as the Cisco Clean Access Server.
Q. Do the software features vary between the models in the Cisco NAC Appliance 3300 Series?
A. No. The only difference is the number of users or the server count allowed by the license.
Q. Are customers still able to purchase the Cisco NAC Appliance software separately?
A. Yes, although this is not recommended. Customers that prefer to purchase their own hardware must first review the certified hardware list at http://www.cisco.com/en/US/products/ps6128/products_device_support_tables_list.html
Q. Can I deploy Cisco Clean Access Servers either in-band or out-of-band?
A. Yes. All Cisco Clean Access Servers can be deployed either in-band or out-of-band; however, one server cannot do both simultaneously. A Cisco Clean Access Manager can manage any combination of in-band and out-of-band servers.
Q. What is the difference between the models within the Cisco NAC Appliance 3300 Series?
A. The three models in the Cisco NAC Appliance 3300 Series differ in their hardware specifications. For more information, please refer to the Cisco NAC Appliance data sheets at http://www.cisco.com/go/nac/appliance.
Q. Is a starter kit still available for pilot deployments?
A. Yes. Customers can still order a bundled Cisco Clean Access Server + Manager software solution for up to 100 users. The part number is CCA-100-SM-BUN-K9. For the hardware, customers can purchase one failover pair to accommodate both components using the part number CCA-3140-H1-FB.
For More Information
For more information about Cisco NAC Appliance hardware and software, visit http://www.cisco.com/go/nac/appliance or contact your local account representative. Inquiries on ordering or deployment sizing can also be e-mailed to cca-questions@external.cisco.com.