Support Information for Cisco NAC Appliance Agents, Release 4.5 and Later
Cisco NAC Appliance Agent System Requirements
Cisco NAC Appliance Agent/Server Version Compatibility
Cisco NAC Agent Interoperability Between NAC Appliance and Identity Services Engine (ISE)
Cisco NAC Appliance Agent/OS/Browser Support Matrix
Cisco NAC Windows Agent/Browser/Java Support
Mac OS X Agent/Browser/Java Support
Windows Clean Access Agent/Browser/Java Support
Cisco NAC Appliance Agent/AD Server Compatibility for AD SSO
Cisco NAC Agent Localized Language Support
Clean Access Agent Localized Language Template Support
Revised: June 9, 2016, OL-18184-01
This document provides the following information for Cisco NAC Appliance Release 4.5 and later:
Table 2 shows Clean Access Server and Agent compatibility between CAM/CAS releases and Agent versions for Windows and Mac OS X client operating systems. Agent client versions listed as compatible can perform basic login/logout for the CAM/CAS version listed and provide the minimum features available for that Agent version or CAM/CAS version (whichever is lower).
The AV/AS support available is determined by the version of the Agent on the client as well as the version of the Cisco NAC Agent Setup or Clean Access Agent Setup/Patch (upgrade) file uploaded to the CAM. For example:
Note The 4.7.1.511 Agent does not provide support for client machines with Windows 7 Starter Edition.
Note For NAC Appliance Release 4.8, the File Distribution requirement type works only when the Agent version is the latest (4.8.0.36). If you are using CAM/CAS version 4.8 with an Agent version earlier than 4.8.0.36, then either use the Link Distribution requirement or upgrade the Agent to the latest version to use the File Distribution. To know more about File Distribution, see the “Configuring Agent-Based Posture Assessment” section in Cisco NAC Appliance - Clean Access Manager Configuration Guide, Release 4.8(3).
Note Windows XP is not supported in 4.9(5) CAM/CAS.
Clean Access Agent Version (Mac OS X 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10)
1
|
|||
---|---|---|---|
4.9.5.7 |
|||
4.9.4.3 |
|||
4.9.5.7 |
|||
4.9.4.3 |
|||
4.9.1.13 |
4.9.1.684 |
||
4.9.1.13 |
4.8.3.6 |
4.9.1.684 |
|
4.8.3.9 |
|||
4.7.5.5 |
|||
4.1(8) 7 |
4.7.5.5 |
||
The Cisco NAC Agent versions 4.9.5.3 and later can be used on both Cisco NAC Appliance Releases 4.9(3), 4.9(4), 4.9(5) and Cisco ISE Releases 1.1.3-patch 11, 1.1.4-patch 11, 1.2, 1.3, 1.4, 2.0, 2.1. This is the recommended model of deploying the NAC agent in an environment where users will be roaming between ISE and NAC deployments.
This section lists the operating systems, web browsers, and Java versions known to work with the Cisco NAC Appliance Agents, version 4.5.0.0 and later.
For Web Login on all operating systems, the ActiveX/Java Applet web client used for L3 MAC address/OS detection and for OOB IP refresh/renew after posture assessment is supported for the web browsers and Java versions listed in each operating system support table.
Note Cisco NAC Agent Software has been announced End-of-Sale (EoS)/End-of-Life (EoL). For information about Windows 10 and MAC OS X 10.10.x support, see the EoS/EoL announcement at the following link: http://www.cisco.com/c/en/us/products/security/nac-appliance-clean-access/eos-eol-notice-listing.html
This section provides CAM/CAS version, browser, and Java JRE compatibility information for web login methods as well as the Cisco NAC Agent (version 4.6.2.113 and later) and Cisco NAC Web Agent that you can install and run on Windows operating systems.
The tables in this section list the Cisco NAC Windows Agent/Browser/Java Support for the following Operating Systems:
Note Windows XP is not supported in 4.9(5).
Supported Browsers
8
|
Java Version
9
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
10
|
Web Login
11
|
Web Agent
12
|
||||
4.7.5.5 |
||||||
1.5.0_01 15 |
||||||
Supported Browsers
16
|
Java Version
17
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
18
|
Web Login
19
|
Web Agent
20
|
||||
4.9.4.3 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
4.8.2.3 |
||||||
4.8.1.5 |
||||||
4.8.0.36 |
||||||
4.7.5.5 |
||||||
Supported Browsers
23
|
Java Version
24
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
25
|
Web Login
26
|
Web Agent
27
|
||||
4.9.4.3 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
4.8.2.3 |
||||||
4.8.1.5 |
||||||
4.8.0.36 |
||||||
4.7.5.5 |
||||||
Supported Browsers
30
|
Java Version
31
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
32
|
Web Login
33
|
Web Agent
34
|
||||
4.9.4.3 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
4.8.2.3 |
||||||
4.8.1.5 |
||||||
4.8.0.36 |
||||||
4.7.5.5 |
||||||
Supported Browsers
37
|
Java Version
38
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
39
|
Web Login
40
|
Web Agent
41
|
||||
4.9.4.3 |
1.6.0_17 |
|||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
4.8.2.3 |
||||||
4.8.1.5 |
||||||
4.8.0.36 |
||||||
4.7.5.5 |
||||||
39.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 41.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 42.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 43.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 44.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
45
|
Java Version
46
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
47
|
Web Login
48
|
Web Agent
49
|
||||
4.9.4.3 |
1.6.0_17 |
|||||
1.6.0_17 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.2.3 |
||||||
4.8.1.5 |
||||||
4.8.0.36 |
||||||
4.7.5.5 |
||||||
47.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 49.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 50.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 51.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 52.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 53.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
55
|
Java Version
56
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
57
|
Web Login
58
|
Web Agent
59
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
4.9.4.3 |
1.6_0_17 |
|||||
1.6_0_17 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
4.8.2.3 |
||||||
4.8.1.5 |
||||||
4.8.0.36 |
||||||
4.7.5.5 |
||||||
54.Includes all Vista operating systems (Business, Home, Ultimate, Enterprise), both Service Pack1 and Service Pack 2. In OOB modes with IP refresh/renew upon successful login (for example, L3 OOB RIP), Web Login and Web Agent with Windows Vista OS requires local admin users to launch the browser as administrator. 57.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 59.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 60.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 61.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 62.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 63.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 64.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
66
|
Java Version
67
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
68
|
Web Login
69
|
Web Agent
70
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
4.9.4.3 |
1.6_0_17 |
|||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
4.8.2.3 |
||||||
4.8.1.5 |
||||||
4.8.0.36 |
||||||
4.7.5.5 |
||||||
65.Includes all Vista operating systems (Business, Home, Ultimate, Enterprise), both Service Pack1 and Service Pack 2. In OOB modes with IP refresh/renew upon successful login (for example, L3 OOB RIP), Web Login and Web Agent with Windows Vista OS requires local admin users to launch the browser as administrator. 68.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 70.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 71.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 72.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 73.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 74.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
75
|
Java Version
76
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
77
|
Web Login
78
|
Web Agent
79
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 83 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 85 |
||||||
1.6_0_17 |
||||||
Internet Explorer 8.0, 9.0, 10 87 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
77.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 79.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 80.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 81.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 82.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 83.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 84.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 85.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 86.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
89
|
Java Version
90
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
91
|
Web Login
92
|
Web Agent
93
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
4.9.4.3 |
1.6_0_17 |
|||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
88.In OOB, for web login IP refresh to work on a Windows 7 64-bit system with local administrative privileges, add the CAS to the intranet zone with protected mode off. 91.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 93.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 94.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 95.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 96.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 97.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
98
|
Java Version
99
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
100
|
Web Login
101
|
Web Agent
102
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 106 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 108 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
100.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 102.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 103.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 104.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 105.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 106.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 107.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
109
|
Java Version
110
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
111
|
Web Login
112
|
Web Agent
113
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 117 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 119 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
111.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 113.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 114.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 115.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 116.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 117.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 118.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
120
|
Java Version
121
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
122
|
Web Login
123
|
Web Agent
124
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 128 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 130 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
122.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 124.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 125.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 126.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 127.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 128.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 129.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
131
|
Java Version
132
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
133
|
Web Login
134
|
Web Agent
135
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 139 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 141 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
133.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 135.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 136.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 137.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 138.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 139.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 140.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
142
|
Java Version
143
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
144
|
Web Login
145
|
Web Agent
146
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 150 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 152 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
144.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 146.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 147.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 148.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 149.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 150.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 151.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
153
|
Java Version
154
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
155
|
Web Login
156
|
Web Agent
157
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 161 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 163 |
||||||
1.6_0_17 |
||||||
Internet Explorer 8.0, 9.0, 10 165 |
||||||
1.6_0_17 |
||||||
Internet Explorer 8.0, 9.0, 10 167 |
||||||
4.9.1.13 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 15 |
||||||
4.9.0.47 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 15 |
||||||
4.8.3.9 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 15 |
||||||
1.6_0_17 |
||||||
Internet Explorer 8.0, 9.0, 10 15 |
||||||
1.6_0_17 |
||||||
Internet Explorer 8.0, 10 15 |
||||||
1.6_0_17 |
||||||
Internet Explorer 8.0, 10 15 |
||||||
1.6_0_17 |
||||||
1.6_0_17 |
||||||
1.6_0_17 |
||||||
155.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 157.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 158.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 159.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 160.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 161.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 162.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 163.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 164.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 165.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 166.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
168
|
Java Version
169
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
170
|
Web Login
171
|
Web Agent
172
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 176 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 178 |
||||||
4.9.1.13 |
||||||
4.9.0.47 |
||||||
4.8.3.9 |
||||||
170.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 172.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 173.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 174.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 175.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 176.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 177.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
179
|
Java Version
180
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
181
|
Web Login
182
|
Web Agent
183
|
||||
4.9.5.7 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 187 |
||||||
4.9.4.3 |
1.6_0_17 |
|||||
Internet Explorer 8.0, 9.0, 10 189 |
||||||
4.9.1.13 |
||||||
4.7(2)190 |
||||||
4.7(1)191 |
181.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 183.If users are logging in via the Web Agent in a Windows 7 environment and have proxy connections configured on Internet Explorer, they must enable “Protected Mode” in the browser’s security settings to enable Web Agent download on the client machine. 184.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 185.To avoid ActiveX initiation issues that could affect Agent download and web login functions, ensure users logging in via Windows 7 client machines maintain “elevated privileges” on the system by keeping the User Access Control (UAC) settings at the “default” level. 186.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 187.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 188.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 189.When Internet Explorer 10 is installed on Windows 7, to get full network access, you need to update to March 2013 Hotfix ruleset. 190.You must upgrade both the CAM/CAS to Release 4.7(2) and the Cisco NAC Agent to version 4.7.2.10 to enable Cisco NAC Agent support on client machines running Windows 7 Starter Edition. 191.For Cisco NAC Appliance Release 4.7(1), the Cisco NAC Agent and Cisco NAC Web Agent do not support Windows 7 Starter Edition. Client machines with the Windows 7 Starter Edition operating system can only perform web login to verify user credentials. For more information on enabling web login for client machines running Windows 7 Starter Edition, see the “Known Issues” section of the Release Notes for Cisco NAC Appliance, Version 4.7(2). |
Supported Browsers
192
|
Java Version
193
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
194
|
Web Login
195
|
|||||
Web Agent (ActiveX/Applet)
196
|
||||||
Internet Explorer 10197 |
1.6_0_17 |
|||||
Internet Explorer 10199 |
1.6_0_17 |
|||||
Internet Explorer 10201 |
1.6_0_17 |
|||||
194.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 196.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 198.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 200.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 202.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Supported Browsers
203
|
Java Version
204
|
|||||
---|---|---|---|---|---|---|
Cisco NAC Agent
205
|
Web Login
206
|
|||||
Web Agent (ActiveX/Applet)
207
|
||||||
Internet Explorer 10208 |
1.6_0_17 |
|||||
Internet Explorer 10210 |
1.6_0_17 |
|||||
205.Testing on international languages has been verified with ActiveX. Although Cisco believes the installer runs successfully in the foreign language with Java, this has not been verified. In the event of a Java installer issue, Cisco NAC Agent installation on international language operating systems defaults to English. 207.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 209.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. 211.Java version 1.6_0_18 can cause a certificate authentication error. Refer to the caveat CSCte58249 in Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. |
Table 23 provides CAM/CAS version, browser, and Java JRE compatibility information for Apple operating systems on Macintosh client machines.
Note For full 4.5 and later features (e.g. Mac OS X posture assessment), the 4.5.x.x Agent must be run with release 4.5 or later CAM/CAS.
Java Version
213
|
||||
---|---|---|---|---|
4.8.2.591 |
Google Chrome 3 and later 217 |
|||
4.9.2.703 |
4.9(x) 218 |
Google Chrome 3 and later 6 |
||
Mac OS X 10.6.4 “Snow Leopard” (32- and 64-bit) 220 |
4.9.4.3 |
Note Mac OS X 10.6 and earlier versions are not supported in 4.9(5). |
Google Chrome 3 and later 6 |
|
4.9.4.3 |
Google Chrome 3 and later 6 |
|||
4.9(4) |
Google Chrome 3 and later 6 |
|||
Google Chrome 3 and later 6 |
||||
Google Chrome 3 and later |
214.Cisco NAC Appliance recognizes iOS as “Macintosh All” and supports basic web login only if Safari browser is used. Cisco has released a patch update for Cisco NAC Appliance Release 4.7(2) CASs that provides web login (no persistent or temporal Agents) support for Apple iPads. See caveat CSCtf60530 in the Release Notes for Cisco NAC Appliance, Version 4.7(2) for more information. This patch has been integrated in Cisco NAC Appliance Release 4.7(3) and Release 4.8. 217.Web login IP refresh does not work with Firefox 4.0 and Google Chrome 8 or later. You need to launch Firefox 4.0 or Google Chrome as Administrator with sudo. 219.Web login via Safari 5.0 may not work with MAC OS 10.5.x and with Java for Mac OS X 10.5 Update 6 and Update 7. 220.The Cisco Mac OS X VPN Client version 4.9.x does not support Mac OS X 10.6 in 64-bit mode. Cisco recommends using the built-in Mac OS X 10.6 Cisco IPSec client when connecting via IPSec VPN or AnyConnect where Cisco SSL VPN is available. 221.For NAC Appliance Release 4.8(3), you need to download a server patch to work with the Mac OS X 10.8 clients. Refer to Release Notes for Cisco NAC Appliance, Version 4.8(3). |
Table 24 provides CAM/CAS version, Java applet, browser, and Java JRE compatibility information for Linux operating systems.
Table 25 provides CAM/CAS version, browser, and Java JRE compatibility information for web login methods as well as the pre-release 4.6(1) Clean Access Agent (version 4.5.0.0 through 4.5.2.0) and Cisco NAC Web Agent that you can install and run on Windows operating systems.
Win Clean Access Agent
226
|
Web Login
227
|
Supported Browsers
228
|
Java Version
229
|
||||
---|---|---|---|---|---|---|---|
Web Agent (ActiveX/Applet)
230
|
|||||||
Windows 2000, SP4 231 |
|||||||
Windows Vista 232 SP1, SP2 |
|||||||
226.The Clean Access Agent only fully supports authentication/posture assessment/remediation on 32-bit operating systems. Any client OS not listed is not supported, even if the Agent can be installed on the client (e.g. Embedded XP is not supported). 230.The temporal Cisco NAC Web Agent can be launched from the Web Login Facilitator using ActiveX from the Internet Explorer versions or via Java applet from the web browsers listed as supported for Windows systems. 231.Agent (4.1.3.0 or later) login to Windows 2000 system with Local DB authentication to CAM and requirements configured requires a system restart. See the Release Notes for Cisco NAC Appliance, Version 4.5 for details. |
Cisco NAC Appliance supports Windows Single Sign-On (SSO) on Windows 8/7/Vista/XP/2000 client machines and Active Directory on Windows 2000/2003/2008/2012 Servers, as shown in Table 26 .
Note Cisco NAC Web Agent does not support SSO functions.
Active Directory (AD) Servers
233
|
Client Machines
234
|
||
---|---|---|---|
Windows 2008 Server Enterprise R2 SP1 (64-bit) |
|||
Windows 2012 Server (32-bit and 64-bit) 237 |
|||
|
|||
Windows 2012 Server (32-bit and 64-bit) 241 |
|||
|
|||
Windows 2012 Server (32-bit and 64-bit) 245 |
|||
|
|||
|
|||
|
|||
234.AD SSO requires the Cisco NAC Agent to be installed on client systems (for example, you cannot use a Linux Kerberos client for AD SSO with Cisco NAC Appliance.) 236.To support AD SSO on the Windows 2008 Server SP1, you must: 237.Run KTPass to allow multiple algorithms for Windows 2012 Server at 2003 Server functional level. Refer to “Configuring Active Directory Single Sign-On (AD SSO)” chapter of the corresponding Cisco NAC Appliance - Clean Access Server Configuration Guide for more information. 238.If the AD system is based on an upgrade from Windows Server 2003, you must raise the domain functionality to Windows Server 2008 level for Cisco NAC appliance to perform SSO on Windows 7 clients. Without this you will not be able to automatically login to the Cisco NAC Appliance network. 239.Users logging into Cisco NAC Appliance via AD SSO must be running Windows Vista or Windows 7 and have one of the supported Cisco NAC Agent versions (4.7.1.15 or 4.8.0.36) installed on their client machine in order to remain FIPS-compliant. Windows XP clients performing AD SSO do not conform to FIPS 140-2 compliance requirements. 241.Run KTPass to allow multiple algorithms for Windows 2012 Server at 2003 Server functional level. Refer to “Configuring Active Directory Single Sign-On (AD SSO)” chapter of the corresponding Cisco NAC Appliance - Clean Access Server Configuration Guide for more information. 242.If the AD system is based on an upgrade from Windows Server 2003, you must raise the domain functionality to Windows Server 2008 level for Cisco NAC appliance to perform SSO on Windows 7 clients. Without this you will not be able to automatically login to the Cisco NAC Appliance network. 243.Users logging into Cisco NAC Appliance via AD SSO must be running Windows Vista or Windows 7 and have one of the supported Cisco NAC Agent versions (4.7.1.15 or 4.8.0.36) installed on their client machine in order to remain FIPS-compliant. Windows XP clients performing AD SSO do not conform to FIPS 140-2 compliance requirements. 245.Run KTPass to allow multiple algorithms for Windows 2012 Server at 2003 Server functional level. Refer to “Configuring Active Directory Single Sign-On (AD SSO)” chapter of the corresponding Cisco NAC Appliance - Clean Access Server Configuration Guide for more information. 246.If the AD system is based on an upgrade from Windows Server 2003, you must raise the domain functionality to Windows Server 2008 level for Cisco NAC appliance to perform SSO on Windows 7 clients. Without this you will not be able to automatically login to the Cisco NAC Appliance network. 247.Users logging into Cisco NAC Appliance via AD SSO must be running Windows Vista or Windows 7 and have one of the supported Cisco NAC Agent versions (4.7.1.15 or 4.8.0.36) installed on their client machine in order to remain FIPS-compliant. Windows XP clients performing AD SSO do not conform to FIPS 140-2 compliance requirements. 249.If the AD system is based on an upgrade from Windows Server 2003, you must raise the domain functionality to Windows Server 2008 level for Cisco NAC appliance to perform SSO on Windows 7 clients. Without this you will not be able to automatically login to the Cisco NAC Appliance network. 250.Users logging into Cisco NAC Appliance via AD SSO must be running Windows Vista or Windows 7 and have one of the supported Cisco NAC Agent versions (4.7.1.15 or 4.8.0.36 or 4.9.0.47) installed on their client machine in order to remain FIPS-compliant. Windows XP clients performing AD SSO do not conform to FIPS 140-2 compliance requirements. 252.If the AD system is based on an upgrade from Windows Server 2003, you must raise the domain functionality to Windows Server 2008 level for Cisco NAC appliance to perform SSO on Windows 7 clients. Without this you will not be able to automatically login to the Cisco NAC Appliance network. 253.Users logging into Cisco NAC Appliance via AD SSO must be running Windows Vista or Windows 7 and have one of the supported Cisco NAC Agent versions (4.7.1.15 or 4.8.0.36) installed on their client machine in order to remain FIPS-compliant. Windows XP clients performing AD SSO do not conform to FIPS 140-2 compliance requirements. |
Cisco NAC Agent version 4.6.2.113 and later provides native localization support of user-facing dialog text and messages. The Agent determines the correct language template based on the local computer Locale (under Control Panel > Regional and Language Options), unless you explicitly disable this function by setting the “Locale” parameter in the Agent configuration XML file. The Agent also provides MultiByte Character Support (MBCS) for posture assessment and remediation on “double-byte” language operating systems. The following languages are supported:.”
Polish 255 |
|||
Note If you use the latest version of the Cisco NAC Agent, but leave your CAM/CAS at release 4.5(1) or earlier, Agent connect-time information (e.g. remediation requirement names and descriptions) is English-only—users lose the advantage of the native operating system localization support available to Cisco NAC Agent users who are logging in to a 4.6(1) and later CAM/CAS network.
The Clean Access Agent determines the correct language template based on the local computer Locale (under Control Panel > Regional and Language Options). Agent language template support only controls what the viewer sees after the Agent is installed; it does not include support for different client operating systems for the Agent Installer or for AV/AS products.
Version 4.5.x.x of the Clean Access Agent supports the following localized language templates:
Note For the Russian localized template, the Agent must run on Russian Windows to be able display all characters correctly.
All languages supported for language templates are also supported for OS Locales. Japanese is also supported as an OS Locale. With OS Locale support, the Clean Access Agent installs/authenticates on the Windows language version (e.g. German Windows or Japanese Windows) but displays all information and instructions in English.
Note For details on the Clean Access Agent for Release 4.1(x) and earlier, refer to Supported Hardware and System Requirements for Cisco NAC Appliance (Cisco Clean Access).