Downloads |
This document describes the ordering guidelines for the Cisco® NAC Appliance product effective October 1, 2009.
What's New in This Guide?
This version of the guide incorporates the next-generation hardware for the Cisco NAC Appliance.
Next-Generation Appliances
Customers can use the next-generation appliances in combination with the existing, appliance-based Cisco NAC Servers and NAC Managers. Table 1 outlines the additional options customers have.
Table 1. Cisco NAC Appliance Options
Cisco NAC Hardware Platforms
The Cisco NAC Appliance runs on the Cisco NAC Appliance 3300 Series hardware. Each hardware platform in the series supports several license requirements. Table 2 maps the licenses to the corresponding hardware.
Table 2. Mapping of Cisco NAC Appliance 3300 Series to Licenses
Sizing the Deployment
The number of online, concurrent users in a deployment determines the type and quantity of Cisco NAC Servers required. In turn, the type and quantity of Cisco NAC Servers determines the type of Cisco NAC Manager required. Refer to Table 2 above for correct selection of the NAC Manager and Servers for the deployment.
About Failover Bundles
Failover bundles are denoted by the "FB" in each part number. Customers that purchase a failover bundle will receive two appliances and a failover license that counts both appliances as one redundant unit. Failover bundles are not available for the Cisco NAC Network Module.
When sizing the Cisco NAC Manager, it is useful to note that one Cisco NAC Server failover bundle counts as one server toward the capacity of the manager. Thus, a Cisco NAC Super Manager can manage up to 40 Cisco NAC Server failover bundles.
Sample Scenarios
The following scenarios illustrate some Cisco NAC Appliance deployments.
Scenario 1
Customer has one headquarters location with 300 users, and two remote sites with fewer than 50 users at each site. Customer prefers a central deployment, using Layer 3 in-band capability to consolidate the remote sites.
|
Management |
1 Cisco NAC Lite Manager with failover |
NACMGR-LTEFB-K9 |
|
Headquarters |
1 Cisco NAC Server with failover for 500 users |
NAC3315-500FB-K9 |
Scenario 2
Customer has one headquarters location with 500 users. Customer would like to provide wireless guest access for its conference rooms (estimated number of users as high as 200) and enforce security policies on employee wired access in an out-of-band deployment. Based on these requirements, a central deployment is recommended, with one Cisco NAC Server with failover for wireless users, and another for wired users.
Scenario 3
Customer has one headquarters location with 4500 users and 10 branch offices with 50 users each. Customer would like to provide posture assessment for all employees. Based on these requirements, a central deployment is recommended.
Part Numbers for Appliances
Tables 3 and 4 list the part numbers for the Cisco NAC Server and Cisco NAC Manager.
Table 3. Part Numbers for Cisco NAC Server
Table 4. Part Numbers for Cisco NAC Manager
Part Numbers for the Cisco NAC FIPS Module
Table 5 lists the part numbers associated with the Cisco NAC FIPS Module.
Table 5. Part Numbers for Cisco NAC FIPS Module
Part Numbers for the Cisco NAC Network Module
Table 6 lists the part numbers associated with the Cisco NAC Network Module.
Table 6. Part Numbers for Cisco NAC Network Module for Integrated Services Routers
When configuring a Cisco 2800 or 3800 Series Integrated Services Router chassis or bundle, select part number NME-NAC-K9 as an option within Network Modules. After confirming the software version for the NAC Network Module, select between the two Cisco NAC Network Module Server Licenses: part number NACNM-50-K9 or NACNM-100-K9.
If you initially purchase the 50-user license (NACNM-50-K9) for the NAC Network Module, you can upgrade to the 100-user license later by ordering part number NACNM-50UL=. You can select the license part numbers and apply them to the module spare (NME-NAC-K9=) in a similar manner.
Licensing information is available at http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/license.html.
Part Numbers for Support
Four types of Cisco SMARTnet® support services are available for Cisco NAC customers:
• 8x5xNBD: Next business day (order must be received before cutoff time)
• 8x5x4: Standard 4-hour service
• 24x7x4: Premium 4-hour service
• 24x7x2: Premium 2-hour service
For more information about Cisco SMARTnet service offerings, please visit http://www.cisco.com/en/US/products/svcs/ps3034/ps2827/ps2978/serv_group_home.html.
Support for Cisco NAC Servers and Cisco NAC Managers is sold separately. Support for the Cisco NAC Network Module is included in the SMARTnet service for Integrated Services Routers.
Tables 7 lists the part numbers of the four service options available for Cisco NAC Server. Table 8 lists the part numbers of the four service options available for Cisco NAC Manager. Table 9 lists the part numbers for upgrade licenses for the NAC Servers. Table 10 lists the part numbers for upgrade eDelivery license support.
Table 7. Cisco NAC Server Support Part Numbers
Table 8. Cisco NAC Manager Support Part Numbers
Table 9. Upgrade License Support Part Numbers
Table 10. Upgrade eDelivery License Support Part Numbers (Same as Upgrade License Part Numbers)
Q&A
Q. Can a FIPS card be ordered separately for the new appliances?
A. No. On the new Cisco NAC Appliances, the FIPS card can be ordered only at the time of ordering the new appliance, as an option item. If an appliance is ordered without the FIPS card, the card cannot be individually purchased later and added to the appliance.
Q. Can one Cisco NAC Manager manage a deployment containing both Cisco NAC Servers and Cisco NAC Network Modules?
A. Yes. One Cisco NAC Manager can manage deployments with both appliance-based and network-module-based NAC Servers.
Q. Does the Cisco NAC Network Module have the same capabilities as a NAC Server?
A. Yes. The Cisco NAC Network Module has the same capabilities as a Cisco NAC Server.
Note: Current NAC 4.7.0 release does not have support for NAC Network Module. Future NAC 4.7.2 release will have the support for NAC network modules.
Q. Do the software features vary between the different models of Cisco NAC Appliances i.e NAC3315/55/95?
A. No. The only difference is the number of users or the server count allowed by the license.
Q. Can I deploy Cisco NAC Servers either in-band or out-of-band?
A. Yes. All Cisco NAC Servers can be deployed either in-band or out-of-band; however, one server cannot do both simultaneously. A Cisco NAC Manager can manage any combination of in-band and out-of-band servers.
Q. What is the difference between the various models of Cisco NAC Appliances i.e. 3315/55/95?
A. The three models in the Cisco NAC Appliance 3300 Series differ in their hardware specifications. For more information, please refer to the Cisco NAC Appliance data sheets at http://www.cisco.com/go/nac/appliance.
Q. Is a starter kit still available for pilot deployments?
A. Yes. Customers can order a Cisco NAC Server + Manager bundled solution for up to 100 users. The part number is NAC3315-NFR-BUN-K9.
For More Information
For more information about Cisco NAC, visit http://www.cisco.com/go/nac or contact your local account representative. Inquiries on ordering or deployment sizing can also be e-mailed to
cca-questions@external.cisco.com.
cca-questions@external.cisco.com.