Worldwide [change] |Account |Register |About Cisco
Guest

Hierarchical Navigation

Cisco NAC Appliance (Clean Access)

Cisco NAC Support for Apple Macintosh OSX 10.6 and Microsoft Windows 7

Downloads

Overview

Q. What is Cisco addressing in this document?
A. Currently, the Cisco® NAC Appliance has not released an agent that supports Mac OSX 10.6 (Snow Leopard) or Windows 7. This affects your ability to perform posture assessment or single sign-on (SSO) on those operating systems.

An interim workaround is available. Although it will result in your not being able to perform posture assessment or SSO for Mac OSX 10.6 or Windows 7, it will enable your users to gain network access. Cisco NAC Release 4.7.1 is planned for release the week of November 23, 2009, and it will contain agents for Mac OSX 10.6 and Windows 7. To take advantage of this new capability, you will have to upgrade your Cisco NAC Server, Manager, and Agent to this release.

Q. Are there any other related issues?
A. NAC Release 4.7.1 will resolve any compatibility concerns relating to Windows 7 and Mac OSX 10.6 for most use cases. However, there are a few specific use cases that NAC Release 4.7.1 will not resolve. These are detailed below:

• NAC Network Module Deployments: NAC Network Modules will not support Windows 7 or Mac OSX 10.6 until NAC Release 4.7.2 is available. Workarounds detailed in the documentation will need to be in place until the availability of NAC Release 4.7.2. A release date will be available shortly.

• NAC 4.1.x Software-Only Deployments: If you currently use NAC Release 4.1.x on non-Cisco hardware, you will have to migrate to a Cisco NAC Appliance-based solution in order to run NAC Release 4.7.1. The Cisco NAC Migration Program will enable you to upgrade to NAC Release 4.7.1 with the upcoming next-generation appliances. Please contact your channel partner or Cisco account representative for details on the NAC Migration Program.

• NAC FIPS Deployments: The upcoming NAC Release 4.7.0 is FIPS-certified. In NAC Release 4.7.1, Cisco NAC Agents for Windows 7 and Mac OSX 10.6 will not be FIPS-certified, but those agents will be certified as part of NAC Release 4.7.2. As indicated earlier, a NAC Release 4.7.2 release date will be available shortly.

The Solution

Q. How is Cisco addressing the issue?
A. We are offering both a short-term workaround and a longer-term resolution to the problem. The short-term workaround will enable devices with Windows 7 and Mac OSX 10.6 operating systems to access the network, but will provide neither posture assessment and remediation nor SSO. In the short term, this will provide you with the ability to enable authenticated network access when using these platforms.

In order to resolve the issue, we're introducing a Cisco NAC Release 4.7.1, which will be available the week of November 23. This release will resolve the issue, except for the three use cases outlined earlier. You will have to upgrade to Cisco NAC Release 4.7.1 to take advantage of the release's capabilities.

Q. Can you provide more information regarding the workaround?
A. A workaround using Web-browser-based authentication has been validated, as has the ability to perform MAC exception handling. This will allow users on Windows 7 and Mac OSX 10.6 operating systems to gain access to the network. Note: This workaround will not provide posture assessment or SSO capability.

For Windows 7 clients, browser-based (Internet Explorer 8) user authentication can be used to perform user authentication and allow/deny end-user access to your network. The NAC Agent will not be downloaded onto the Windows 7 client; therefore, posture assessment will not be performed.

For Mac OSX 10.6 clients, browser-based (Firefox 3.5) user authentication can be used to perform user authentication and allow/deny end-user access to your network. The NAC Agent will not be downloaded onto the Mac OSX 10.6 client; therefore, posture assessment will not be performed. We have identified an issue related to the use of Safari. This issue is currently being investigated, and we hope to have it resolved shortly.

For Windows 7 and Mac OSX 10.6, the Java applet needs to be used with Internet Explorer 8 and Firefox 3.5, respectively. You can find the detailed workaround document at http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/presentation_NAC_Solution_Workaround_for_Win.pdf.

Q. What should I expect in terms of how the NAC solution will perform with the workaround in place?
A. The following table outlines the specific capabilities and behaviors of the NAC solution with the workaround in place.

NAC Appliance Releases 4.1.8, 4.5.1, 4.6.1

Current Users with Agent

New Users

Current Users with Agent Attempting Web Authentication

Windows XP/Vista

No change: User will go through agent login and posture assessment as before

Agent is mandatory: User will be asked to download the agent

Agent is mandatory: User will be asked to download the agent

Windows 7

-

Web authentication using Internet Explorer 8 and Java applet*

-

Mac OSX 10.5 and below

No change: User will go through agent login and posture assessment as before

Web authentication only

Web authentication will succeed and user will not be asked to download agent

Mac OSX 10.6 (Snow Leopard)

-

(Remove the agent if it is already installed)

Web authentication using Firefox and Java applet*

-

*An Active X solution is being investigated. The workaround documentation will have the updated information.
Q. When will the workaround be available?
A. The complete workaround process is currently available. You can find the detailed workaround document at http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/presentation_NAC_Solution_Workaround_for_Win.pdf.
Q. What are the plans for releasing a software version to address the issue?
A. NAC Release 4.7.1 is targeted for the week of November 23.

Note: NAC Release 4.7.1 will not support NAC Network Modules. Also, NAC Agents running on Windows 7 and Mac OSX 10.6 will not be FIPS-certified. Support for these scenarios will be part of NAC Release 4.7.2. A deployment guide for these scenarios will be part of the NAC Release 4.7.1 release package.

Q. How do I upgrade to NAC Release 4.7.1 from NAC Release 4.5.x?
A. As part of your existing active support contract, you are entitled to upgrade your software from NAC Release 4.5.x to NAC Release 4.7.1. Specific upgrade steps will be posted as part of NAC Release 4.7.1.
Q. How do I upgrade to NAC Release 4.7.1 from NAC Release 4.6.x?
A. As part of your existing active support contract, you are entitled to upgrade your software from NAC Release 4.6.x to NAC Release 4.7.1. Specific upgrade steps will be posted as part of NAC Release 4.7.1.
Q. How do I upgrade to NAC Release 4.7.1 from NAC Release 4.1.x?
A. If you are running NAC Release 4.1.x on Cisco NAC hardware (Cisco NAC 3140, 3310, 3350 or 3390 Appliance) as part of your existing active support contract, you are entitled to upgrade your software from NAC Release 4.1.x to NAC Release 4.7.1. Specific upgrade steps will be posted as part of NAC Release 4.7.1.

If you are running NAC Release 4.1.x on non-Cisco NAC hardware, you will have to migrate to a Cisco hardware appliance (Cisco NAC 3140, 3310, 3350 or 3390 Appliance). The existing NAC Migration Program is being refreshed to enable you to upgrade to NAC Release 4.7.1 with the upcoming next-generation appliances. Please contact your channel partner or Cisco account representative for details on the NAC Migration Program.

Q. What steps is Cisco taking to address a longer-term solution to this problem?
A. The current situation has underscored the need to provide appropriate and timely support for new operating systems, service packs, software updates, and hot fixes. Moving forward, the plan is to support new OS releases as follows.

Based on Microsoft's structured release cycle, we have set the following targets for an available NAC release:

• Upon availability of an RTM (Release to Manufacturing) from Microsoft, Cisco's target will be to support an EFT version of NAC within 4 weeks.

• When Microsoft has released product for general availability, Cisco's target will be to support the release with FCS product on the same day.

• Microsoft Service Pack target availability will mirror the OS release target availability.

• Existing hot-fix target availability will continue at 72 hours.

Note: If Microsoft introduces nontrivial changes post-RTM, it may affect our ability to deliver support at FCS.

Based on Apple's release cycle, we have set the following targets for an available NAC release:

• Upon availability of beta software ("seeds") from Apple, Cisco's target will be to offer best-effort support of an EFT version of NAC within 4 weeks.

• When Apple has released product for general availability, Cisco's target will be to support the release with FCS product within 4 weeks.

• Apple software updates target availability will continue to be on a case-by-case basis.

Changes to target release availability for OS, service pack, hot fix, browser, and security software versions will be phased in after NAC Release 4.7.1. As part of this effort, we are creating a separate NAC sustaining engineering team to expedite and issue regular releases of NAC independent from new feature versions.

We also plan to include the Fast Opswat feature in NAC Release 4.7.2; this will expedite support for newer antivirus/antispam versions. Currently, support of newer antivirus/antispam versions is tied to agent code, meaning that a newer version of the Cisco NAC Agent needs to be released to support the latest antivirus/antispam versions. With Fast Opswat, the antivirus/antispam version support and agent version will be decoupled, which will expedite the antivirus/antispam support.

Q. You've moved in the delivery date for NAC Release 4.7.1. What are the implications with respect to the features originally intended for delivery with NAC Release 4.7.1?
A. NAC Release 4.7.1 will not support any additional feature enhancements that were included in the original release that was scheduled for 1QC10. This includes out-of-band logout and reporting enhancements. Given the need to accelerate NAC Release 4.7.1 to resolve the Windows 7/Mac OSX 10.6 issue, these incremental features have been moved to a proposed release (NAC Release 4.7.2). Availability will be announced shortly.

Note: Many of the products and features described herein are in development and will be offered on a when-and-if-available basis. This roadmap is subject to change at the sole discretion of Cisco, and Cisco will have no liability for delay in the delivery of, or failure to deliver, any of the products or features set forth in this document.