Getting Started with Cisco NAC Network Modules in Cisco Access Routers
Available Languages
Table Of Contents
Getting Started with Cisco NAC Network Modules in Cisco Access Routers
About Cisco NAC Network Module for Integrated Services Routers
Prerequisites for Cisco NAC Network Module
Accessing the Cisco NAC Network Module
Restrictions for Cisco NAC Network Module
Cisco NAC Network Module and Clean Access Server Software
Cisco NAC Network Module (CAS) Deployment Modes
Example Layer 2 Inband Virtual Gateway Configuration
Integrated Services Router Configuration (L2 IB VGW)
EtherSwitch Service Module (NME-ESW) Configuration (L2 IB VGW)
Example Layer 2 Out-of-Band Real-IP Gateway Configuration
CAS Configuration (L2 OOB RGW)
Integrated Services Router Configuration (L2 OOB RGW)
EtherSwitch Service Module (NME-ESW) Configuration (L2 OOB RGW)
How to Configure the Cisco NAC Network Module
Cisco NAC Network Module Configuration Worksheet
Setting Up Network Module Interfaces
Running Clean Access Server Software Configuration Utility
Important Notes for SSL Certificates
How to Operate, Maintain, and Troubleshoot Cisco NAC Network Module
Shutting Down and Starting Up Cisco NAC Network Module
Upgrading Cisco NAC Appliance Software on the Cisco NAC Network Module
Re-Installing Cisco NAC Network Module Software
Configuring and Administering Cisco NAC Appliance
Obtaining Documentation and Submitting a Service Request
Getting Started with Cisco NAC Network Modules in Cisco Access Routers
Revised: November 27, 2012, OL-2609-01Contents
•
About Cisco NAC Network Module for Integrated Services Routers
•
•
•
•
•
•
About Cisco NAC Network Module for Integrated Services Routers
The Cisco® NAC Network Module for Integrated Services Routers (NME-NAC-K9) brings the feature-rich Cisco NAC Appliance Server capabilities to Cisco 2800 and 3800 Series Integrated Services Routers.
In addition, Cisco NAC Appliance Releases 4.8 and later support Cisco 2900 and 3900 Series Integrated Services Routers.
Cisco NAC Appliance
Cisco NAC Appliance (also known as Cisco Clean Access) is a Network Admission Control (NAC) product that allows network administrators to authenticate, authorize, evaluate, and remediate wired, wireless, and remote users and their machines prior to allowing users onto the network. It identifies whether networked devices such as laptops, desktops, and corporate assets are compliant with a network's security policies, and it repairs any vulnerabilities before permitting access to the network.
Cisco NAC Appliance is a network-centric integrated solution that is:
•
•
•
You can deploy the Cisco NAC Appliance solution in the configuration that best meets the needs of your network.
Cisco NAC Network Module
The Cisco NAC Network Module (NME-NAC-K9) implements the Clean Access Server functionality on the next generation service module for the Cisco 2811/2821/2851 and 3825/3845 access routers. The NAC network module is pre-installed with Cisco NAC Appliance software release 4.1(2) (or later), with the Clean Access Server software running as the application code.
In addition, Cisco NAC Appliance Releases 4.8 and later support Cisco 2911/2921/2951 and 3925/3945 access routers.
The Clean Access Server operating system is based on an optimized version of Linux. The NAC network module is an ideal NAC solution for small groups of users in remote locations where an integrated services router is used. The NAC network module can be equipped with either a 50-user or 100-user license to support branch offices.
The Clean Access Manager is purchased separately as a NAC-3300 series appliance and is the primary point of configuration and management for all Clean Access Servers—whether implemented as a Cisco NAC Network Module in an Integrated Services Router, or as a NAC-3310 or NAC-3350 SERVER appliance. Once initial configuration is complete, the NAC network module is added and managed by the Clean Access Manager like any other Clean Access Server through the CAM web console (GUI) interface.
For further details on the NAC-3300 series server platforms refer to the Cisco NAC Appliance Hardware Installation Quick Start Guide.
Prerequisites for Cisco NAC Network Module
Router
•
•
–
–
–
–
–
•
–
–
–
–
–
Note
•
Note
Network Module
Note
Cisco NAC Network Module supports L3 Wireless Out-of-Band (L3 OOB) introduced in Cisco NAC Appliance Release 4.8(2).
•
Refer to the latest version of the Release Notes for Cisco NAC Appliance for enhancement details for each applicable release.
•
•
Table 1 Network Module Hardware Specifications
NME-NAC-K9
1 GHz Celeron M
80 GB (SATA)
512 MB DDR
64 MB
•
–
–
Note
File Server
•
–
–
Accessing the Cisco NAC Network Module
•
Note
•
–
–
–
–
•
Restrictions for Cisco NAC Network Module
Deployment
•
•
•
•
Upgrade
•
To resolve this, check the system clock after upgrading, set it once and reboot. To set the date again use the following command and reboot.
Syntax:
date -s "dd MMM YYYY hh:mm:ss"Example:
date -s "15 APR 2010 19:49:00"You can also synchronize the time using the CAS web console. In the CAS web console, perform the following steps:
Step 1
Step 2
Step 3
Step 4
•
Note
Note
Note
Note
Cisco NAC Network Module and Clean Access Server Software
The Clean Access Server is a Linux-based application that resides on the NAC network module that plugs into a host Cisco router running Cisco IOS software.
The network module is a standalone services engine with its own startup and run-time configurations that are independent of the Cisco IOS configuration on the router. The module does not have an external console port. Instead, you launch and configure the module through the router, by means of a configuration session on the module. After the session, you return to the router CLI and clear the session.
This arrangement—host router plus network module (the latter is also sometimes called an appliance or blade or, with installed software, a service or services engine)—provides a router-integrated application platform for accelerating data-intensive applications. Such applications typically involve the following and more:
•
•
•
•
•
•
Network Admission Control (NAC) enabled by Cisco NAC Appliance is such an application.
This section contains the following information:
•
System Licenses
Cisco NAC Appliance product licensing treats the Cisco NAC Network Module as any other Clean Access Server. In order for a NAC network module to work in your system, you need the following:
•
•
The CAM license is based on the eth0 IP address of the CAM and corresponds to the number of Clean Access Servers it supports. There are licenses for: Lite Manager (supports 3 CASs), Standard Manager (supports 20 CASs), and Super Manager (supports 40 CASs) .•
This is a type of Clean Access Server license. The CAS license is based on the number of concurrent users it supports. The NAC network module can support up to 100 online, concurrent users. Table 2 shows the license types available for the NAC network module. These software licenses can also be used for the ordering of a spare NAC network module.
Note
For complete details on licensing, refer to Cisco NAC Appliance Service Contract / Licensing Support .
Deployment Overview
This section provides a overview of Cisco NAC Network Module deployment with some configuration examples. If you already know how you want to deploy your NAC network module, continue to How to Configure the Cisco NAC Network Module for detailed initial configuration steps.
It contains the following:
•
•
•
Cisco NAC Network Module (CAS) Deployment Modes
Table 3 shows the Clean Access Server deployment modes supported by the Cisco NAC Network Module.
Table 3 CAS Deployment Modes Supported by Cisco NAC Network Module
Physical deployment
Edge deployment only
CAS traffic passing
•
•
Client access
•
•
Traffic flow
•
•
1 The Cisco NAC Network Module does not support Wireless Out-of-Band deployment (Release 4.5 and later). Wireless OOB only supports Layer 2 OOB Virtual Gateway deployments that require no IP change. The NAC Network Module does not support this topology.
From a physical deployment perspective, all NAC network modules are Edge Deployments. This means each port (eth0 and eth1) of the NAC network module (CAS) is connected to a different device.
The eth1 (untrusted) interface of the NAC network module can be connected to an external switch or to an EtherSwitch Service Module (NME-ESW) for 3800 series integrated services routers supporting multiple slots (e.g. 3845).
Interface Description
Table 4 describes the interface terminology used in the example deployments shown in Figure 1 and Figure 2.
The example scenarios illustrate the NAC network module (NME-NAC) in a 3800 Series Integrated Services Router (ISR) when an EtherSwitch Service Module (NME-ESW) is used instead of an external switch.
In both examples, the eth1(untrusted) interface of the NAC network module (Clean Access Server) is connected via external link to the EtherSwitch module (instead of internal Gigabit Serdes (GigSerdes) connection)
Example Layer 2 Inband Virtual Gateway Configuration
This section describes the following:
•
•
•
Network Diagram (L2 IB VGW)
Figure 1 shows the Cisco NAC Network Module deployed as a CAS in Layer 2 inband Virtual Gateway mode.
Figure 1 NME-NAC (CAS) Layer 2 Inband Virtual Gateway Deployment with NME-ESW
Key Points
•
•
•
•
•
•
CAS Configuration (L2 IB VGW)
The example in this section illustrates the main concepts for configuring the CAS as a Layer 2 Inband Virtual Gateway.
•
•
CAS IP Form (L2 IB VGW)
•
•
•
•
•
Note
CAS Managed Subnet Form (L2 IB VGW)
•
•
•
•
•
•
CAS VLAN Mapping Form (Disable VLAN Mapping/VLAN Pruning)
•
•
Caution
•
Integrated Services Router Configuration (L2 IB VGW)
EtherSwitch Service Module (NME-ESW) Configuration (L2 IB VGW)
Example Layer 2 Out-of-Band Real-IP Gateway Configuration
This section describes the following:
•
•
•
Network Diagram (L2 OOB RGW)
Figure 2 shows the NAC module deployed as a CAS in Layer 2 out-of-band Real-IP Gateway mode.
Figure 2 NME-NAC (CAS) Layer 2 Out-of-Band Real-IP Gateway Deployment with NME-ESW
Key Points
•
•
•
CAS Configuration (L2 OOB RGW)
The example in this section illustrates the main concepts for configuring the CAS as a Layer 2 Out-of-Band Real-IP Gateway.
•
•
•
•
•
CAS IP Form (L2 OOB RGW)
•
•
•
•
•
Note
CAS Managed Subnet Form (L2 OOB RGW)
•
•
•
•
•
•
CAS DHCP Form (L2 OOB RGW)
•
•
CAM - Switch Profile (L2 OOB RGW)
•
•
CAM - Port Profile (L2 OOB RGW)
•
•
CAM - SNMP Receiver (L2 OOB RGW)
•
•
CAM - Ports Management (L2 OOB RGW)
•
•
Integrated Services Router Configuration (L2 OOB RGW)
EtherSwitch Service Module (NME-ESW) Configuration (L2 OOB RGW)
Additional References
For more information on Gigabit Serdes/HIMI, refer to:
•
For more information on EtherSwitch Service Modules, refer to:
•
•
For more information on Clean Access Server configuration, refer to the applicable:
•
•
For OOB support information, see:
•
How to Configure the Cisco NAC Network Module
This section contains the following information:
•
•
•
•
Note
Initial configuration of the network module is done via CLI (router console). Thereafter, the Cisco NAC Network Module is a Clean Access Server that is managed via Clean Access Manager (CAM) web console. The CAS on the NAC network module can be accessed by: router console, CAM/CAS web console, and SSH.
This document presents router console configuration instructions.
For CAM/CAS web console (GUI) configuration instructions, refer to the following guides. Refer to the document version corresponding to the release you are running on your machines:
•
•
Hardware Interfaces
The host router and network module use several interfaces for internal and external communication (see Figure 3). Each interface is configurable—for the router by using the Cisco IOS CLI and for the module by using the module firmware's CLI, GUI, or SSH.
Figure 3 Router and Network Module Interfaces
Cisco NAC Network Module Configuration Worksheet
You will need to collect the information in Table 5, first to configure the Cisco NAC Network Module within the Integrated Services Router (ISR), then to configure the Clean Access Server software that will run on the NAC network module.
Setting Up Network Module Interfaces
Your first configuration task is to set up network module interfaces to the host router and to its external links, which enables you to access the module to install and configure NAC.
Note
SUMMARY STEPS
From the Host-Router CLI
1.
2.
3.
4.
or
ip unnumbered type number
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enters privileged EXEC mode on the host router. Enter your password if prompted.
Step 2
configure terminal
Example:Router# configure terminal
Enters global configuration mode on the host router.
Step 3
interface integrated-service-engine slot/0
Example:ISR 2811 (one-slot only):
Router(config)# interface integrated-service-engine 1/0
Example:ISR 3845 (multiple-slot):
Router(config)# interface integrated-service-engine 3/0
Enters interface configuration mode for the slot and port where the network module resides.
Step 4
ip address router-side-ip-address subnet-mask
or
ip unnumbered type number
Example:Router(config-if)# ip address 10.30.30.10 255.255.255.0
or
Router(config-if)# ip unnumbered ethernet 0
Specifies the router interface to the module (#2 in Figure 3). Arguments are as follows:
•
•
Step 5
service-module ip address module-side-ip-address subnet-mask
Example:Router(config-if)# service-module ip address 10.30.30.9 255.255.255.0
Specifies the IP address for the module interface to the router (#3 in Figure 3).
Note
Arguments are as follows:
•
•
Step 6
service-module external ip address external-ip-address subnet-mask
Example:Router(config-if)# service-module external ip address 172.0.0.30 255.255.255.0
Specifies the IP address for the external LAN interface on the module (#4 in Figure 3).
Note
Arguments are as follows:
•
•
Step 7
service-module ip default-gateway gateway-ip-address
Example:Router(config-if)# service-module ip default-gateway 10.30.30.10
Specifies the IP address for the default gateway router for the module. The argument is as follows:
•
Step 8
end
Example:Router(config-if)# exit
Returns to global configuration mode on the host router.
Step 9
copy running-config startup-config
Example:Router# copy running-config startup-config
Saves the router's new running configuration.
Step 10
show running-config
Example:Router# show running-config
Displays the router's running configuration, so that you can verify address configurations.
Examples
The following partial output from the show running-config command shows how the interfaces are configured.
NME-NAC-3845#sh run interface integrated-service-engine 3/0Building configuration...Current configuration : 197 bytes!interface integrated-service-engine3/0ip address 10.30.30.10 255.255.255.0service-module ip address 10.30.30.9 255.255.255.0service-module ip default-gateway 10.30.30.10no keepaliveendOpening and Closing a Session
You can now open and close a session on the network module.
Note
•
SUMMARY STEPS
From the Host-Router CLI
1.
2.
3.
From the Service-Module Interface
4.
5.
From the Host-Router CLI
6.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enters privileged EXEC mode on the host router. Enter your password if prompted.
Step 2
service-module integrated-service-engine slot/0 status
Example:Router# service-module integrated-service-engine 2/0 status
Displays the status of the specified module, so that you can ensure that the module is running (that is, in steady state).
Note
Step 3
service-module integrated-service-engine slot/0 session
Example:Router# service-module integrated-service-engine 1/0 session
Trying 10.10.10.1, 2065 ... Open
Begins a session on the specified module. Do one of the following:
•
•
Step 4
Fedora Core release 4 (Stentz)
Kernel 2.6.11-perfigo on an i686
NME-NAC login: root
See Running Clean Access Server Software Configuration Utility for instructions on how to perform the initial configuration of the Clean Access Server software on the NAC network module.
Step 5
Press Control-Shift-6 x.
Closes the service-module session and returns to the router CLI.
Note
Step 6
service-module integrated-service-engine slot/0 session clear
Example:Router# service-module service-engine 1/0 session clear
Clears the service-module session for the specified module. When prompted to confirm this command, press Enter.
Running Clean Access Server Software Configuration Utility
The first time the NAC network module session is initiated, the Clean Access Server quick configuration utility prompts appears. This section details the CAS Configuration Utility steps.
DETAILED STEPS
Step 1
root
Example:Fedora Core release 4 (Stentz)Kernel 2.6.11-perfigo on an i686NME-NAC login: rootWelcome to the Cisco Clean Access Server quick configuration utility.Note that you need to be root to execute this utility.The utility will now ask you a series of configuration questions. Please answer them carefully.Cisco Clean Access Server, (C) 2008 Cisco Systems, Inc.Please use ^H to deleteConfiguring the network interfaces:
From the network module prompt, log into the Clean Access Server Configuration Utility as the root user.
The first time you login, there is no password prompt.Note
–
–
Step 2
module-side-ip-address
Example:Please enter the IP address for the interface eth0 [10.201.2.30]: 10.201.217.203
You entered 10.201.217.203 Is this correct? (y/n)? [y]
At the first prompt, type an IP address for the eth0 (trusted) interface of the CAS (from field a of the CAS Worksheet) and press Enter. Confirm the value when prompted, or type n and press Enter to correct the entry.
Note
Step 3
module-side-ip-address subnet-mask
Example:Please enter the netmask for the interface eth0 [255.255.255.0]:
You entered 255.255.255.0, is this correct? (y/n)? [y]
Type the subnet mask for the interface address (from field b) at the prompt or press Enter for the default (255.255.255.0). Confirm the value when prompted.
Step 4
service-module ip default-gateway
Example:Please enter the IP address for the default gateway [10.201.217.1]: 10.201.217.202
You entered 10.201.217.202 Is this correct? (y/n)? [y]
Accept the default gateway address or type a default gateway (from field c) for the eth0 address of the CAS and press Enter. Confirm the default gateway at the prompt.
Step 5
y-or-n
Example:[Vlan Id Passthrough] for packets from eth0 to eth1 is disabled.
Would you like to enable it? (y/n)? [n]
At the VLAN ID Passthrough prompt, type n and press Enter (or just press Enter) to keep VLAN ID passthrough disabled as the default behavior of the CAS. By default, VLAN IDs are stripped from traffic passing through the interface to the CAS. Typing y enables VLAN IDs to be passed through the CAS for traffic from the trusted to the untrusted network.
Note
Step 6
y-or-n
Example:[Management Vlan Tagging] for egress packets of eth0 is disabled.
Would you like to enable it? (y/n)? [n]
At the Management VLAN Tagging prompt, type n and press Enter (or just press Enter) to keep Management VLAN tagging disabled (default). Or, type Y and press Enter to enable Management VLAN tagging with the specified VLAN ID for the eth0 interface.
Note
Note
Step 7
external-ip-address
Example:Please enter the IP address for the untrusted interface eth1 [192.168.110.1]: 10.201.243.49
You entered 10.201.243.49 Is this correct? (y/n)? [y]
Type an IP address for the eth1 (untrusted) interface of the CAS (from field d) and press Enter. Confirm the value when prompted, or type n and press Enter to correct the entry.
Note
Step 8
external-ip-address-subnet-mask
Example:Please enter the netmask for the interface eth1 [255.255.255.0]: 255.255.255.240
You entered 255.255.255.240, is this correct? (y/n)? [y]
Type the subnet mask of the eth1 interface (from field e) or press Enter to accept the default of 255.255.255.0. Confirm the value at when prompted.
Step 9
external-ip-address-default-gateway
Example:Please enter the IP address for the default gateway [10.201.243.1]: 10.201.243.49
You entered 10.201.243.49 Is this correct? (y/n)? [y]
Enter the default gateway address for the eth1 untrusted interface (from field f):
a.
b.
Step 10
y-or-n
Example:[Vlan Id Passthrough] for packets from eth1 to eth0 is disabled.
Would you like to enable it? (y/n)? [n]
At the next prompt, type n and press Enter (or just press Enter) to keep VLAN ID passthrough disabled for the eth1 interface.
Step 11
y-or-n
Example:[Management Vlan Tagging] for egress packets of eth1 is disabled.
Would you like to enable it? (y/n)? [n]
At the Management VLAN Tagging prompt, type n and press Enter (or just press Enter) to keep Management VLAN tagging disabled (default) for the eth1 interface.
Step 12
clean-access-server-host-name
Example:Please enter the hostname [caserver]: cas-10
You entered cas-10 Is this correct? (y/n)? [y]
Type and confirm the host name for the Clean Access Server (from field g).
Step 13
dns-server-ip-address
Example:Please enter the IP address for the name server: [171.68.226.120]:
You entered 171.68.226.120 Is this correct? (y/n)? [y]
Type the IP address of the DNS server in your environment (from field h) or accept the default at the following prompt:
Step 14
nac-shared-secret
Example:The shared secret used between Clean Access Manager and Clean Access Server is the default string: cisco123
This is highly insecure. It is recommended that you choose a string that is unique to your installation.
Please remember to configure all Clean Access Devices with the same string.
Only the first 8 characters supplied will be used.
Please enter the shared secret between Clean Access Server and Clean Access Manager: cisco1234
You entered: cisco1234
Is this correct? (y/n)? [y]
Type and confirm the shared secret for the CAM and CAS (from field i) at the prompts.
Caution
Step 15
region-number
Example:>>> Configuring date and time:
The timezone is currently not set on this system.
Please identify a location so that time zone rules can be set correctly.
Please select a continent or ocean.
1) Africa
2) Americas
3) Antarctica
4) Arctic Ocean
5) Asia
6) Atlantic Ocean
7) Australia
8) Europe
9) Indian Ocean
10) Pacific Ocean
11) none - I want to specify the time zone using the Posix TZ format.
#? 2
Specify time settings for the Clean Access Server (from field j) as follows:
Choose your region from the continents and oceans list. Type the number next to your location on the list, such as 2 for the Americas, and press Enter. Type 11 to enter the time zone in Posix TZ format, such as
GST-10.Step 16
country-number
Example:Please select a country.
1) Anguilla 18) Ecuador 35) Paraguay
2) Antigua & Barbuda 19) El Salvador 36) Peru
3) Argentina 20) French Guiana 37) Puerto Rico
4) Aruba 21) Greenland 38) St Kitts & Nevis
5) Bahamas 22) Grenada 39) St Lucia
6) Barbados 23) Guadeloupe 40) St Pierre & Miquelon
7) Belize 24) Guatemala 41) St Vincent
8) Bolivia 25) Guyana 42) Suriname
9) Brazil 26) Haiti 43) Trinidad & Tobago
10) Canada 27) Honduras 44) Turks & Caicos Is
11) Cayman Islands 28) Jamaica 45) United States
12) Chile 29) Martinique 46) Uruguay
13) Colombia 30) Mexico 47) Venezuela
14) Costa Rica 31) Montserrat 48) Virgin Islands (UK)
15) Cuba 32) Netherlands Antilles 49) Virgin Islands (US)
16) Dominica 33) Nicaragua
17) Dominican Republic 34) Panama
#? 45
The next list that appears shows the countries for the region you chose. Choose your country from the country list, such as 45 for the United States, and press Enter.
Step 17
timezone-number
Example:Please select one of the following time zone regions.
1) Eastern Time
2) Eastern Time - Michigan - most locations
3) Eastern Time - Kentucky - Louisville area
4) Eastern Time - Kentucky - Wayne County
5) Eastern Time - Indiana - most locations
6) Eastern Time - Indiana - Crawford County
7) Eastern Time - Indiana - Starke County
8) Eastern Time - Indiana - Switzerland County
9) Central Time
10) Central Time - Indiana - Daviess, Dubois, Knox, Martin, Perry & Pulaski Counties
11) Central Time - Indiana - Pike County
12) Central Time - Michigan - Dickinson, Gogebic, Iron & Menominee Counties
13) Central Time - North Dakota - Oliver County
14) Central Time - North Dakota - Morton County (except Mandan area)
15) Mountain Time
16) Mountain Time - south Idaho & east Oregon
17) Mountain Time - Navajo
18) Mountain Standard Time - Arizona
19) Pacific Time
20) Alaska Time
21) Alaska Time - Alaska panhandle
22) Alaska Time - Alaska panhandle neck
23) Alaska Time - west Alaska
24) Aleutian Islands
25) Hawaii
#? 19
If the country contains more than one time zone, the time zones for the country appears.
Choose the appropriate time zone region from the list, such as 19 for Pacific Time, and press Enter.
Step 18
confirmation-number
Example:The following information has been given:
United States
Pacific Time
Is the above information OK?
1) Yes
2) No
#? 1
Updating timezone information...
Confirm your choices by entering 1, or use 2 to cancel and start over.
Step 19
y-or-n
or
hh:mm:ss mm/dd/yy
Example:Current date and time hh:mm:ss mm/dd/yy [11:23:33 08/22/08]: 11:26:33 08/22/08You entered 11:26:33 08/22/08 Is this correct? (y/n)? [y]Type and confirm the current date and time, using format hh:mm:ss mm/dd/yy.
Note
Step 20
<certificate fields>
Example:You must generate a valid SSL certificate in order to use the Clean Access Server's secure web console.
Please answer the following questions correctly.
Information for a new SSL certificate:
Enter fully qualified domain name or IP: 10.201.217.203
Enter organization unit name: Test
Enter organization name: Cisco Systems
Enter city name: San Jose
Enter state code: California
Enter 2 letter country code: US
Follow the prompts to configure the temporary SSL security certificate that secures the login exchange between the Clean Access Server and untrusted (managed) clients (using field k):
a.
b.
c.
d.
•
Step 21
y-or-n
Example:You entered the following:
Domain: 10.201.217.203
Organization unit: Test
Organization name: Cisco Systems
City name: San Jose
State code: California
Country code: US
Is this correct? (y/n)? [y]
Generating SSL Certificate...
CA signing: /root/.tomcat.csr -> /root/.tomcat.crt:
CA verifying: /root/.tomcat.crt <-> CA cert
/root/.tomcat.crt: OK
Done
Confirm values and press Enter to generate the SSL certificate, or type n to restart:
Step 22
y-or-n
Example:Enable Prelogin Banner Support? (y/n)? [n]
Confirm whether to enable the Pre-login Banner for admin users before they log into the CAS (Release 4.5 and later).
Administrators can specify the text of the Pre-login Banner by enabling this feature on the appliance, logging into the command-line console, and editing the /root/banner.pre file. The text of the Pre-login Banner appears in both the web console interface and the command-line interface when admin users are logging into the CAM/CAS. See the installation chapter of the Cisco NAC Appliance - Clean Access Server Installation and Configuration Guide, Release 4.5 for details.
Step 23
root-user-password
Example:For security reasons, it is highly recommended that you change the password for the root user.** Please enter a valid password for root user as per the requirements below! **Changing password for user root.You can now choose the new password.A valid password should be a mix of upper and lower case letters,digits, and other characters. Minimum of 8 characters and maximumof 16 characters with characters from all of these classes. Minimumof 2 characters from each of the four character classes is mandatory.An upper case letter that begins the password and a digit that endsit do not count towards the number of character classes used.Enter new password:Re-type new password:passwd: all authentication tokens updated successfully.
Type the root user password for the installed Linux operating system of the CAS (from field l). The root user account is used to access the system over direct/serial/SSH connection.
Starting from Release 4.5, the default root user password (cisco123) is removed, and Cisco NAC Appliance supports Strong Passwords only for root user login. Passwords must be at least 8 characters long and contain at least two characters from each of the following four categories: lower-case letters, upper-case letters, numbers (digits), and special characters (such as !@#$%^&*~).
For example, 1o-9=OnE is a valid password, but the password 10-9=One does not satisfy requirements because it does not contain two characters from each category. For further details, see the "Manage System Passwords" section in the "Administer the CAM" chapter of the Cisco NAC Appliance - Clean Access Manager Installation and Configuration Guide, Release 4.5.
Step 24
web-console-admin-password
Example:Example:Please enter an appropriately secure password for the web console admin user.
New password for web console admin:
Confirm new password for web console admin:
Web console admin password changed successfully.
Type the admin user password for the CAS direct access web console (from field m). The CAS web console provides limited CAS-specific settings, and is primarily used to set up High Availability.
Step 25
reboot
Example:Configuration is complete.[root@NME-NAC ~]# rebootBroadcast message from root (ttyS0) (Fri Aug 22 11:45:36 2008):The system is going down for reboot NOW![root@cas-10 ~]#
After the configuration is complete, wait for the prompt, then type reboot to reboot the CAS.
Note
The CAS initial configuration is now complete.
Step 26
From CAS:
ping cam-ip-address
From CAM (ping CAS eth0 address):
ping 10.201.217.203 ...
Ping the CAM from the CAS to verify that the CAM and CAS can ping (route) to each other.
Step 27
https://<CAS IP address>/admin
Type the CAS IP address into the URL/address field of a web browser to verify you can log into the CAS web console. You will need to use the admin user password you configured in .
Note
Step 28
http://<CAM IP address> /admin
Log into the CAM web console by typing the CAM IP address into the URL/address field of a web browser.
From the CAM web console:
•
•
Cisco NAC Appliance Configuration Quick Start Guide, or
Cisco NAC Appliance - Clean Access Manager Installation and Configuration Guide (applicable to your release)
Step 29
Press Control-Shift-6 x.
Close the service-module session and returns to the router CLI.
Note
Step 30
service-module integrated-service-engine slot/0 session clear
Example:Router# service-module service-engine 1/0 session clear
Clear the service-module session for the specified module. When prompted to confirm this command, press Enter.
Important Notes for SSL Certificates
•
•
•
How to Operate, Maintain, and Troubleshoot Cisco NAC Network Module
This section contains the following information:
•
•
•
Note
–
(Example:Router(config-if)#?).–
(Example:Router#service-module integrated-service-engine ?).•
Shutting Down and Starting Up Cisco NAC Network Module
To shut down or start up the Cisco NAC network module or the Clean Access Server application that runs on the module, use commands as needed from the following list of common router and network module commands (Table 6).
Note
•
Verifying System Status
To verify the status of an installation, upgrade, or downgrade or to troubleshoot problems, use commands as needed from the following list of common router and network module commands (Table 7).
Note
Upgrading Cisco NAC Appliance Software on the Cisco NAC Network Module
To upgrade the Cisco NAC Network Module to the latest supported Cisco NAC Appliance release, a single product upgrade file (cca_upgrade-<version>.tar.gz) is uploaded and applied to the CAS. This section describes the following upgrade procedures:
Note
Note
Note
Note
See Restrictions for Cisco NAC Network Module for additional information.
CAS Upgrade via CLI
You can upgrade the CAS on your NAC network module by using the command line upgrade procedure described in this section.
Note
SUMMARY STEPS
From the Host-Router CLI
1.
2.
3.
From the Service-Module Interface
4.
5.
From the Host-Router CLI
6.
DETAILED STEPS (CAS UPGRADE)
Step 1
a.
b.
c.
d.
•
•
•
•
•
e.
Note
Download the Cisco NAC Appliance product upgrade file.
Step 2
root
Example:Fedora Core release 4 (Stentz)Kernel 2.6.11-perfigo on an i686NME-NAC login: rootFrom the network module prompt, log into the Clean Access Server Configuration Utility as the root user to access the command line of the CAS.
Step 3
cat /perfigo/build
Example:[root@cas128 ~]# cat /perfigo/build
VERSION=4.1.2.1
NAME=Clean Access Server
DATE=2007/09/07
Verify the current Cisco NAC Appliance software version on the CAS.
Step 4
Copy the upgrade file to /store directory of the CAS.
Example:If using WinSCP or SSH File Transfer:
a.
If using PSCP:
a.
b.
c.
pscp cca_upgrade-4.5.0-NO-WEB.tar.gz
root@ipaddress_server:/store
Copy the upgrade file to the /store directory of the CAS using WinSCP, SSH File Transfer or PSCP.
Step 5
cd /store
ls
Example:[root@cas128 ~]# cd /store
[root@cas128 store]# ls
cca_upgrade-4.5.0-NO-WEB.tar.gz
On the CAS, change directory to /store and verify the upgrade package is there.
Step 6
tar zxf cca_upgrade-<version>.tar.gz
ls
Example:[root@cas128 store]# tar xzf cca_upgrade-4.5.0-NO-WEB.tar.gz
[root@cas128 store]# ls
cca_upgrade-4.5.0 cca_upgrade-4.5.0-NO-WEB.tar.gz upload
[root@cas128 store]#
Extract the contents of the upgrade file.
Step 7 .
cd cca_upgrade-<version>
./UPGRADE.sh
Example:[root@cas128 store]# cd cca_upgrade-4.5.0
[root@cas128 cca_upgrade-4.5.0]# ls
agent-version.sh checksum.txt notes.html version.sh
cam-4.5.x-upgrade.sh checksum.txt.sig RPMS
cas-4.5.x-upgrade.sh dmidecode showstate.sh
cca_upgrade-4.1.6.tar.gz initrd.img UPGRADE.sh
[root@cas128 cca_upgrade-4.5.0]# ./UPGRADE.sh
...stopping CCA Server...
BaseAgent process stopped!
Stopping DHCP...
In Maintenance Mode...
Welcome to the CCA Server migration utility.
...Upgrading to newer rpms of 4.5.0...done.
...Upgrading CCA files... done
Clearing Tomcat cache...checking ssl configuration...done.
[root@cas128 cca_upgrade-4.5.0]#
Change to the
/cca_upgrade-<version> directory and execute the upgrade process.Step 8
[root@cas128 cca_upgrade-4.5.0]# reboot
Example:[root@cas128 cca_upgrade-4.5.0]# reboot
Broadcast message from root (pts/0) (Tue Oct 21 18:49:00 2008):
The system is going down for reboot NOW!
[root@cas126 cca_upgrade-4.5.0]#
Reboot the CAS after upgrade is complete.
Step 9
cat /perfigo/build
Example:[root@cas128 ~]# cat /perfigo/build
NAME=Clean Access Server
DATE=2008/10/20
AUTHOR=rachnar
BUILD_TAG=NAC-4_5_0-RC9
BUILD_INFO=Experimental
BUILT_ON=mercury
REBUILD_COUNT=0
Verify the new build after the CAS reboot.
Step 10
Press Control-Shift-6 x.
Close the service-module session and return to the router CLI.
Note
Step 11
service-module integrated-service-engine slot/0 session clear
Example:Router# service-module service-engine 1/0 session clear
Clear the service-module session for the specified module. When prompted to confirm this command, press Enter.
CAS Upgrade via Web Console
If upgrading the CAS on your NAC network module to Cisco NAC Appliance Release 4.1(6) or earlier only, you can use the same web upgrade procedure used to upgrade standalone CAS appliances as described in the "Upgrading" section of the applicable Release Notes for Cisco NAC Appliance.
Note
CAS Web Upload
•
/store/upload. The web uploaded file will also have a randomly-generated numeric code appended to the .tar.gz file (e.g.cca_upgrade-<version>.tar<digit code>.gz•
/storefor Release 4.5 and later. The web uploaded file also has a randomly-generated numeric code appended to the .tar.gz file (e.g.cca_upgrade-<version>.tar<digit code>.gz•
•
nme-nac-upgrade-<version>-from-4.6.x.tar.gz•
cca_upgrade-<version>-from-4.7.x-4.8.x.tar.gz•
nme-nac-upgrade-<version>-from-4.8.x.tar.gz
Note
Note
Note
Re-Installing Cisco NAC Network Module Software
By default, the Cisco NAC Network Module is preconfigured to load the operating system and Clean Access Server software from the onboard flash. In most cases, the administrator will only need to perform the initial Clean Access Server configuration of the network module, then can use the normal Cisco NAC Appliance upgrade procedure to later upgrade the software on the module. See Configuring and Administering Cisco NAC Appliance for additional information.
If the machine is corrupt or cannot be booted, you can interrupt and change the boot process (by entering ***) in order to reimage the entire system. This process requires downloading the boot helper and image files separately from the Cisco Secure Software site, and configuring a TFTP server so that the boot helper can be loaded onto the network module from the network.
In this case, two items of boot software may be used:
•
•
This section contains the following information:
•
•
•
Re-Imaging the Network Module
Re-installing the network module involves installing, configuring, and starting a boothelper image. The boothelper, in turn, starts the Cisco NAC Appliance software installation on the NAC network module and brings up the Clean Access Server Configuration Utility which will prompt you through the configuration of the CAS.
Prerequisites
•
SUMMARY STEPS
From the Host-Router CLI
1.
2.
3.
From the Service-Module Interface
4.
5.
6.
7.
8.
From the Host-Router CLI
9.
DETAILED STEPS
Step 1
a.
b.
c.
d.
•
•
e.
Download the Cisco NAC Network Module installation-package files (boothelper image and installation image).
Note
Step 2
enable
Example:Router> enable
Enter privileged EXEC mode on the host router. Enter your password if prompted.
Step 3
service-module integrated-service-engine slot/0 reset
Example:Router# service-module integrated-service-engine 1/0 resetAfter the download completes, reset the system.
Step 4
service-module integrated-service-engine slot/0 session
***
Example:Router# service-module integrated-service-engine 1/0 session***
If the reset does not automatically do so, open a session and quickly type *** to interrupt the auto-boot sequence and access the bootloader:
Step 5
Configure the bootloader to load and launch the boothelper.
Prompts to configure the bootloader interface appear in the order listed. For each, enter a value or accept the previously stored input that appears inside square brackets by pressing Enter.
•
•
•
•
•
•
•
•
•
•
Step 6
(Optional) Verify your bootloader configuration settings:
Step 7
After the new configuration finishes writing, start the boothelper at the boot prompt.
Step 8
Follow boothelper instructions. The helper will present the following options:
1.
2.
3.
4.
5.
Enter 1 to install everything.
Step 9
(Virtual Gateway only)
eth0 IP address
subnet mask
default gateway
Example:
Please enter the IP address for the interface eth0: 10.201.243.18You entered 10.201.243.18 Is this correct? (y/n)? [y]Please enter the netmask for the interface eth0: 255.255.255.240You entered 255.255.255.240, is this correct? (y/n)? [y]Please enter the IP address for the default gateway: 10.201.243.17You entered 10.201.243.17 Is this correct? (y/n)? [y]Creating partitions with fdisk...If installing on a previously configured Virtual Gateway system, you will additionally be asked for the eth0 IP address, netmask, and gateway.
Step 10
nme-nac-install-<version>-K9.img
Example:Please enter the Image name: nme-nac-install-4.5_0-K9.imgYou entered nme-nac-install-4.5_0-K9.img Is this correct? (y/n)? [y]After partitioning and formatting the hard disk, the helper will ask two more questions (image name and TFTP server address)
Type the image name (e.g. nme-nac-install-<version>-K9.img) and press Enter.
Confirm that this is correct by typing y and pressing Enter.
Step 11
TFTP server IP address
Example:Please enter the IP address for the tftp server: 10.201.210.15You entered 10.201.210.15 Is this correct? (y/n)? [y]Transferring Image nowDone!Success!Type the IP address of your TFTP server.
Confirm that this is correct by typing y and pressing Enter.
The helper will then transfer the image. The image is quite large, and the transfer takes a long time. After the image is transferred the helper will display status as RPMs get installed.
Step 12
Press Enter
Example:Press enter to rebootAt the reboot prompt, press the Enter key and the NAC network module will reboot.
Step 13
root
Example:Fedora Core release 4 (Stentz)Kernel 2.6.11-perfigo on an i686NME-NAC login: rootOn next boot up, the network module login prompt appears. Login as root
The standard Clean Access Server Configuration Utility questions will then be asked. Follow the instructions in Running Clean Access Server Software Configuration Utility to complete the CAS configuration.
Step 14
reboot
After completing the Configuration Utility, at the prompt, reboot your NAC network module.
On next reboot, the NAC network module installation is complete.
Step 15
Press Control-Shift-6 x.
Close the session by pressing Control-Shift-6 x.
Step 16
service-module integrated-service-engine slot/0 session clear
Example:Router# service-module service-engine 1/0 session clear
From the host-router CLI, clear the session:
Configuring and Administering Cisco NAC Appliance
For comprehensive Cisco NAC Appliance configuration information, refer to the applicable version of the following guides:
•
•
Technical Assistance
The Cisco Technical Support & Documentation website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.
Cisco Feature Navigator website
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. An account on Cisco.com is not required.
Cisco Software Center website
Log in to the Cisco Software Download Site at http://www.cisco.com/public/sw-center/index.shtml. You will likely be required to provide your CCO credentials.
Navigate to Security > Endpoint Security > Cisco Network Access Control > Cisco NAC Appliance to download software for Cisco NAC Appliance.
Documentation
Table 8 Updates to this Guide
11/27/12
Updates (for 4.9(x)):
•
•
9/23/10
Updates (for 4.9):
•
•
7/26/10
Updates (for 4.8):
•
•
•
10/3/08
9/25/08
Updates (for 4.5):
•
•
•
6/11/08
•
•
•
•
•
11/02/07
Minor updates/corrections
8/22/07
Cisco NAC Network Module (NME-NAC-K9) release
Related Documents
For the latest updates to Cisco NAC Appliance documentation on Cisco.com, visit www.cisco.com/go/nac/appliance. Refer to the document versions that correspond to the release you are running on your machines.
Data sheets
Ordering guide
Licensing
System requirements
Supported Hardware and System Requirements for Cisco NAC Appliance (Cisco Clean Access)
Supported switches (OOB)
Release notes
Release Notes for Cisco NAC Appliance (Cisco Clean Access) (Version 4.1(2) or later)
Configuration guides
Cisco NAC Appliance - Clean Access Manager Installation and Configuration Guide
Cisco NAC Appliance - Clean Access Server Installation and Configuration Guide
Appliance hardware (MANAGER/SERVER)
Cisco NAC Appliance Hardware Installation Quick Start Guide, Release 4.1
Network module
Getting Started with Cisco NAC Network Modules in Cisco Access Routers (this guide)
Installing Cisco Network Modules in Cisco Access Routers at
Connecting Cisco Network Admission Control Network Modules at
http://www.cisco.com/en/US/docs/routers/access/interfaces/nm/hardware/installation/guide/nacnm.html
Cisco IOS software
Cisco IOS Software website at http://www.cisco.com/en/US/products/sw/iosswrel/tsd_products_support_category_home.html
Voice and IP communications
Cisco Voice and IP Communications website at http://www.cisco.com/en/US/products/sw/voicesw/tsd_products_support_category_home.html
Tip
To narrow your Cisco.com search to technical documents, from the Cisco.com home page on the upper right under the Search box, click Advanced Search > Technical Support & Documentation and enter your search criteria.
To provide feedback about the Cisco.com website or a particular technical document, from the top of any Cisco.com web page, click Feedback.
Glossary
Note
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as an RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently supports RSS Version 2.0.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2012Cisco Systems, Inc. All rights reserved.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)