 Feedback
|
Table Of Contents
Release Notes for Cisco Clean Access Version 3.5(11)
Cisco NAC Appliance Service Contract/Licensing Support
System and Hardware Requirements
VPN Components Supported for Single Sign-On
Supported Switches for Cisco Clean Access
Software Compatibility Matrixes
Release 3.5(x) Upgrade Compatibility Matrix
Release 3.5(x) Compatibility Matrix
Clean Access Agent Feature Compatibility Matrix
Determining the Software Version
Enhancements for Release 3.5.11.1
Upgrade Instructions for 3.5.11.1
Enhancements for Release 3.5(11)
New "service perfigo maintenance" CLI Command for CAS
Supported AV Product List (Version 42)
Enhancements for Release 3.5(10)
CAS HA (Failover) UI Enhancements
Supported AV Product List (Version 31)
Clean Access Agent Enhancements (3.5.13)
Clean Access Agent Enhancements (3.5.12)
Enhancements for Release 3.5(9)
OOB Port Profile Page Enhancement
Supported AV Product List (Version 26)
Clean Access Agent Enhancements (3.5.11)
Enhancements for Release 3.5(8)
Support for Single Sign-on (SSO) with Cisco Airespace Wireless LAN Controller
Cisco Clean Access OOB Support for Catalyst 4000
Clean Access Agent Enhancements (3.5.10)
Enhancements for Release 3.5(7)
OOB Support for Cisco Catalyst 5500, 2960 Series Switches
OOB Virtual Gateway Enhancements
Clean Access Agent Enhancements (3.5.9)
Supported AV Product List (Version 20)
Enhancements for Release 3.5.6.1
Upgrade Instructions for 3.5.6.1
Enhancements for Release 3.5(6)
Case Insensitivity for Max Sessions per User Account
Clean Access Agent Distribution Enhancements
Clean Access Agent Enhancements (3.5.8)
Supported AV Product List (Version 18)
Enhancements for Release 3.5.5.1
Upgrade Instructions for 3.5.5.1
Important Notes for Release 3.5(5)
OOB Switch Management MAC Address Table Aging Time
Enhancements for Release 3.5(5)
New Enable/Disable L3 Option on CAS
CAS Discovery Host Enhancements
Clean Access Agent Enhancement (3.5.5)
OOB Switch Management SNMP Receiver Enhancements
OOB Switch Management Respects Device Filters
Automatic Update of Default Host Policies
Supported AV Product List (Version 17)
Enhancements for Release 3.5.4.1
Upgrade Instructions for 3.5.4.1
Enhancements for Release 3.5(4)
OOB Support for Cisco Catalyst 3500 XL, 2900 XL, 2940 Series Switches
OOB Switch Management Ports Configuration Enhancements
Agent-AV Support Info Page Enhancements
Supported AV Product List (Version12)
Clean Access Agent (3.5.4) Auto-Upgrade
Enhancements for Release 3.5.3.2
Upgrade Instructions for 3.5.3.2
Enhancements for Release 3.5.3.1
Upgrade Instructions for 3.5.3.1
New Features in Release 3.5(3)
Multi-Hop L3 In-Band Deployment Support
VPN Integration and Single Sign-On (SSO)
System Upgrade via Web Console (3.5(3) and Above)
Automated Daily Database Backups
Enhancements for Release 3.5(3)
Supported AV Product List (Version 9)
Enhancements for Release 3.5.2.2
Upgrade Instructions for 3.5.2.2
Enhancements for Release 3.5.2.1
Supported AV Product List (Version 8)
Upgrading from 3.5(2) to 3.5.2.1
Enhancements for Release 3.5(2)
Supported AV Product List (Version 7)
Known Issues for Release 3.5(2)
New Features in Release 3.5(1)
Clean Access Agent Auto-Upgrade (3.5.1)
Clean Access Agent Displays VPN Information (3.5.1)
Ability to Assign Original VLAN to Authenticated/Certified Devices on Out-of-Band Ports
Ability to Specify Complex Auth Server Mapping Rules
Enhancements for Release 3.5(1)
Event Log Simplified for Rule Auto-Updates
Clean Access Agent Rule Categorization
Enhancement to AV Definition Rules and Requirements
Supported AV Product List (Version 6)
Supported Out-of-Band Switches List Updated
New Features in Release 3.5(0)
Switch Control-Based Out-of-Band (OOB) Product Module
Anti-Virus Software Integration
SNMP Agent Monitoring Services
RADIUS Accounting Enhancements
Clean Access Agent Configuration Enhancements
Clean Access Agent Dialog Enhancements (3.5.0)
Clean Access Server Proxy Settings
Clean Access Agent Enhancements
Enhancements per Agent Version
VPN/L3 Access for Clean Access Agent (3.5.3+)
Clean Access Agent Auto-Upgrade (3.5.1+)
Enabling Agent Auto-Upgrade on the CAM
Disabling Agent Patch Upgrade Distribution to Users
Enabling Mandatory Auto-Upgrade on the CAM
User Experience for Auto-Upgrade
Agent Setup vs. Agent Upgrade Files
Agent Upgrade Through File Distribution Requirement
Manually Uploading the Agent to the CAM
Clean Access Supported Antivirus Product List
Supported AV Products (Windows XP / 2000)
Supported AV Products (Windows ME / 98)
Supported AV Product List Versions
Open Caveats - Release 3.5.11.1
Resolved Caveats - Release 3.5.11.1
Resolved Caveats - Release 3.5(11)
Resolved Caveats - Release 3.5(10)
Resolved Caveats - Release 3.5(9)
Resolved Caveats - Release 3.5(8)
Resolved Caveats - Release 3.5(7)
Resolved Caveats - Release 3.5.6.1
Resolved Caveats - Release 3.5(6)
Resolved Caveats - Release 3.5.5.1
Resolved Caveats - Release 3.5(5)
Resolved Caveats - Release 3.5.4.1
Resolved Caveats - Release 3.5(4)
Resolved Caveats - Release 3.5.3.2
Resolved Caveats - Release 3.5.3.1
Resolved Caveats - Release 3.5(3)
Resolved Caveats - Release 3.5.2.2
Resolved Caveats - Release 3.5.2.1
Resolved Caveats - Release 3.5(2)
Resolved Caveats - Release 3.5(1)
Resolved Caveats - Release 3.5(0)
Known Issues for Cisco NAC Appliance
Installing or Upgrading to a New Software Release
Upgrade via Web Console (from 3.5.3 and Above Only)
Upgrading High Availability Pairs
Accessing Web Consoles for High Availability
Instructions for Upgrading High Availability CAM and CAS
No Web Login Redirect / CAS Cannot Establish Secure Connection to CAM
IE 7.0 Beta and Clean Access Agent
Enable Debug Logging on the Clean Access Agent
Recovering Root Password for CAM/CAS (Release 3.5.x or Below)
Troubleshooting Switch Support Issues
Troubleshooting Network Card Driver Support Issues
Other Troubleshooting Information
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Product Alerts and Field Notices
Obtaining Technical Assistance
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for Cisco Clean Access Version 3.5(11)
Revised: January 4, 2008, OL-7564-01Contents
These release notes provide cumulative late-breaking and release information for Cisco® Clean Access (CCA), release 3.5(x). This document describes new features, changes to existing features, limitations and restrictions ("caveats"), fixes, upgrade instructions, and related documentation. These release notes supplement the Cisco Clean Access documentation included with the distribution. Read these release notes carefully and refer to the upgrade instructions before installing this release.
•
Cisco NAC Appliance Service Contract/Licensing Support
•
•
•
•
•
•
•
Cisco Clean Access Releases
Cisco NAC Appliance Service Contract/Licensing Support
For complete details on licensing, including service contract support, new licenses, evaluation licenses, legacy licenses and RMA, refer to the following web page:
http://www.cisco.com/en/US/products/ps6128/prod_pre_installation_guide09186a008073136b.html
System and Hardware Requirements
This section describes the following:
•
•
Hardware Supported
See Supported Hardware and System Requirements for Cisco NAC Appliance (Cisco Clean Access) for details on:
•
•
•
•
•
VPN Components Supported for Single Sign-On
Table 1 lists VPN components supported for SSO with Cisco Clean Access. Elements in the same row are compatible with each other.
Note
For further details, see:
•
•
•
Supported Switches for Cisco Clean Access
See Switch Support for Cisco NAC Appliance for complete details on:
•
•
•
•
Software Compatibility
This section describes software compatibility for releases of Cisco Clean Access:
•
•
For details on Clean Access Agent client software versions and AV integration support, see:
•
•
Software Compatibility Matrixes
This section describes the following:
•
•
•
Release 3.5(x) Upgrade Compatibility Matrix
Table 2, "Release 3.5(x) Upgrade Compatibility Matrix" shows 3.5 upgrade compatibility. You can upgrade from the release(s) shown to the latest 3.5 release.
Table 2 Release 3.5(x) Upgrade Compatibility Matrix
3.5(11)
3.5(10) 1
3.5(9)
3.5(8)
3.5(7)
3.5.6.1
3.5(6)
3.5.5.1
3.5(5)
3.5(4)
3.5.3.1
3.5(3)
3.5.2.1 2
3.5(2)
3.5(1)
3.5(0)3.5.11.1 3
3.5(11)
3.5(10) 1
3.5(9)
3.5(8)
3.5(7)
3.5.6.1
3.5(6)
3.5.5.1
3.5(5)
3.5.4.1 4
3.5(4)
3.5.3.2 4
3.5.3.1
3.5(3)
3.5.2.2 4
3.5(2)
3.5(1)
3.5(0)3.5.11.1 3
3.5.12 5 ,7,8,9,10
3.5.11 6 ,7 ,8 ,9
3.5.10 7,8,9,10
3.5.9 7,8,9,10
3.5.8 7,8,9,10
3.5.7 7,8,9,10
3.5.6 7,8,9,10
3.5.5 8,9
3.5.4 8,9
3.5.3 8,9
3.5.2 9
3.5.1 9
3.5.0 11 ,123.4(x)
3.3(x)
3.2(6)3.4(x)
3.3(x)
3.2(6)3.4.1 12,13
3.4.0 12,13
3.3.0 12,13,14
3.2.3 12,13,14
3.2.2 12,13,14
1 If planning to migrate to CCA 3.6(x), you can migrate from release 3.5(10) only to release 3.6(2) or above.
2 Upgrade to 3.5.2.1 patch is only performed on the CAM. Version 3.5.2.1 is compatible with release 3.5(2) on the CAS.
3 3.5.11.1 patch can only be applied to 3.5(x) CAM/CAS. See Enhancements for Release 3.5.11.1 and Resolved Caveats - Release 3.5.11.1 for details.
4 Upgrade to 3.5.4.1/3.5.3.2/3.5.2.2 patch is only performed on the CAS.
5 If planning to migrate to CCA 3.6(x), upgrade the 3.5.12 Agent directly to 3.6.2.0 or above Agent.
6 If planning to migrate to CCA 3.6(x), upgrade the 3.5.11 Agent directly to 3.6.1.0 or above Agent.
7 3.5.5+ Agents only support multi-hop L3 operation starting with 3.5(5) CAM/CAS. L3 discovery will not work with prior CAM/CAS versions.
8 Only 3.5(3) and above CAM/CAS/Agent support VPN/L3 access. Agent must be installed from CAS (via Download CCA Agent or Auto-Upgrade). See VPN/L3 Access for Clean Access Agent (3.5.3+).
9 Only 3.5.1+ Agents support Agent Auto-Upgrade. See Clean Access Agent Auto-Upgrade (3.5.1+) for details.
10 3.5.6+ Agents are only compatible with 3.5(5) or greater CAM/CAS, or 3.5.2.2 / 3.5.3.2/ 3.5.4.1 patches of the CAS. See Web Browser Compatibility for details.
11 3.5.0 Agent supports Supported Antivirus Product List, but does not support "ANY" vendor/product AV rules/requirements.
12 3.5.0 and below Agents do not support Agent Auto-Upgrade.
13 3.4.1 Agent and below do not support AV Rule integration features nor the Supported Antivirus Product List.
14 3.3.0 Agent and below do not support network policy URL page and 3.3 clients will not work if CAM/CAS have it enabled.
Caution
Release 3.5(x) Compatibility Matrix
Table 3, "Release 3.5(x) Compatibility Matrix" shows release 3.5.x CAM/CAS/Agent compatibility for the latest version of the Clean Access Agent (3.5.6 and above). Releases listed in the same row are compatible with one another. Cisco recommends synchronizing your software images to match the latest shown as compatible in the table
Clean Access Agent Feature Compatibility Matrix
Table 2, "Agent Compatibility Matrix" shows general feature compatibility of Agent versions for release 3.5.
Table 4 Agent Compatibility Matrix
3.5(x) GD
3.5(x) GD
3.5.13 3,4,5,6
3.5.12 1 ,3,4,5,6
3.5.11 2 ,3,4,5,6
3.5.10 3,4,5,6
3.5.9 3 ,4 ,5 ,6
3.5.8 3,4,5,6
3.5.7 3,4,5,6
3.5.6 3,4,5,6
3.5.5 5,6
3.5.4 5,6
3.5.3 5,6
3.5.2 6
3.5.1 6
3.5.0 7 ,8
3.4.1 8,9
3.4.0 8,9
3.3.0 8,9,10
1 If planning to migrate to CCA 3.6(x), upgrade the 3.5.12 Agent directly to 3.6.2.0 or above Agent.
2 If planning to migrate to CCA 3.6(x), upgrade the 3.5.11 Agent directly to 3.6.1.0 or above Agent.
3 3.5.6+ Agents are only compatible with 3.5(5) or greater CAM/CAS, or 3.5.2.2 / 3.5.3.2/ 3.5.4.1 patches of the CAS. See Web Browser Compatibility for details.
4 3.5.5+ Agents only support multi-hop L3 operation starting with 3.5(5) CAM/CAS. L3 discovery will not work with prior CAM/CAS versions.
5 Only 3.5(3) and above CAM/CAS/Agent support VPN/L3 access. Agent must be installed from CAS (via Download CCA Agent or Auto-Upgrade). See VPN/L3 Access for Clean Access Agent (3.5.3+).
6 Only 3.5.1+ Agents support Agent Auto-Upgrade. See Clean Access Agent Auto-Upgrade (3.5.1+) for details.
7 3.5.0 Agent supports Supported Antivirus Product List, but does not support "ANY" vendor/product AV rules/requirements.
8 3.5.0 and below Agents do not support Agent Auto-Upgrade.
9 3.4.1 Agent and below do not support AV Rule integration features nor the Supported Antivirus Product List.
10 3.3.0 Agent does not support network policy URL accept page and 3.3 clients will not work if CAM/CAS have it enabled.
Web Browser Compatibility
•
•
•
•
Note
Determining the Software Version
Clean Access Manager
•
•
Clean Access Server
•
•
•
Clean Access Agent
•
–
–
–
•
New and Changed Information
This section describes any new features or enhancements added to the following releases of the Cisco Clean Access Manager and Cisco Clean Access Server. For additional details, see also Clean Access Agent Enhancements and Clean Access Supported Antivirus Product List.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Enhancements for Release 3.5.11.1
Release 3.5.11.1 is a general and important bug fix release for the Clean Access Manager and Clean Access Server that resolves the caveats listed in Resolved Caveats - Release 3.5.11.1. No new features are added.
Note
•
For additional details refer to the following sections:
•
•
Upgrade Instructions for 3.5.11.1
To upgrade your CAM/CAS to 3.5.11.1, perform the following steps.
Step 1
Step 2
Step 3
Enhancements for Release 3.5(11)
Release 3.5(11) is a general and important bug fix release for the Clean Access Manager and Clean Access Server, which also includes the following enhancements:
•
•
See Resolved Caveats - Release 3.5(11) for caveats that are resolved with this release.
See Installing or Upgrading to a New Software Release for upgrade instructions.
New "service perfigo maintenance" CLI Command for CAS
Release 3.5(11) provides a new service perfigo maintenance CLI command that can be issued on the CAS machine to maintain network connectivity when bringing the CAS into maintenance mode. In maintenance mode, only the basic CAS router runs and continues to handle VLAN-tagged packets. The new command allows communication through the management VLAN to the CAS, and is intended for environments where the CAS is in trunk mode and the native VLAN is different than the management VLAN. This command provides a better alternative to the service perfigo stop command, which when issued and the management VLAN is set, causes the CAS to lose network connectivity.
Note
Clean Access Agent
The version of the Clean Access Agent remains at 3.5.13 for Cisco Clean Access release 3.5(11) See Clean Access Agent Enhancements (3.5.13).
See Supported AV Product List Versions and Enhancements per Agent Version for additional details.
Supported AV Product List (Version 42)
•
•
Enhancements for Release 3.5(10)
Release 3.5(10) is a general and important bug fix release for the Clean Access Manager and Clean Access Server, and which adds AV support for the Clean Access Agent:
•
•
•
•
See also Resolved Caveats - Release 3.5(10).
Upgrade Enhancements
With SSH upgrade to release 3.5(10) and above, when upgrading the CAM, the script provides an additional prompt to choose whether or not to upgrade the Clean Access Agent files inside the Clean Access Manager. Choosing Yes upgrades the Agent Setup Installation and Patch Installation files to the latest Agent version bundled with the release (for example, Agent 3.5.12 for release 3.5(10)). Choosing No leaves the original Agent Setup and Patch Installation files that were on your CAM prior to upgrade. See Perform SSH Upgrade on the CAM for details.
Note
CAS HA (Failover) UI Enhancements
For an HA-Primary Mode or HA-Standby Mode Clean Access Server, the Disable Serial Login feature is now presented as a checkbox option to display the current status of serial login on the CAS direct access console. This affects the following page:
•
CAS IP Page UI Enhancement
The L3 support checkbox is changed from "Enable L3 support for Clean Access Agent" to "Enable L3 support" on the CAS IP page to more accurately reflect the setting. For multi-hop L3 in-band deployments, this setting enables/disables L3 discovery of the CAS for both web login users and Clean Access Agent users at the CAS level. This affects the following web console page:
•
Supported AV Product List (Version 31)
•
•
Clean Access Agent Enhancements (3.5.13)
Version 3.5.13 of the Clean Access Agent resolves caveat CSCsd84272. See also Supported AV Product List Versions and Enhancements per Agent Version for details.
Clean Access Agent Enhancements (3.5.12)
Version 3.5.12 of the Clean Access Agent provides additional AV product support (Windows XP/2000). See Supported AV Product List Versions for details.
See also Enhancements per Agent Version.
Note
Enhancements for Release 3.5(9)
This section details enhancements to existing features delivered with release 3.5(9) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
See also Resolved Caveats - Release 3.5(9).
OOB Port Profile Page Enhancement
The Port Profile page layout is enhanced to be more user-friendly and now includes the ability to switch a machine to either a User Role-based VLAN or Initial Port VLAN if the device is certified and not on the Out-of-Band Online User List.
This affects the following web console pages:
•
•
Supported AV Product List (Version 26)
•
•
Note
Clean Access Agent Enhancements (3.5.11)
Version 3.5.11 of the Clean Access Agent provides the following enhancements:
•
•
•
See also Enhancements per Agent Version, and Resolved Caveats - Release 3.5(9).
Known Issue for Symantec/Norton Products (3.5.11)
When AV definition updates are performed from the 3.5.11 Clean Access Agent, Symantec/Norton Products will launch their own update UI to perform the update, instead of performing the update behind the scenes as in previous versions of the Agent. When the Symantec/Norton Product UI is launched and is updating, any more clicks on the Update button of the CCA Agent will create a considerable load on the machine to launch more windows and cause the update process to fail. With a higher number of clicks, this can also cause the updater to fail. Cisco advises waiting until the Symantec/Norton UI launched completes its update and closes on its own.
Enhancements for Release 3.5(8)
This section details enhancements to existing features delivered with release 3.5(8) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
See also Resolved Caveats - Release 3.5(8).
API Enhancements
With release 3.5(8), the Cisco Clean Access API utility script, cisco_api.jsp, provides three new functions that will allow administrators to create, delete, and view local user accounts on the CAM (local users are those internally validated by the CAM as opposed to an external authentication server):
•
•
•
The Clean Access API for your Clean Access Manager is accessed from a web browser as follows: https://<cam-ip-or-name>/admin/cisco_api.jsp.
These APIs are intended to support guest access for dynamic token user access generation, providing the ability to:
•
•
•
These APIs will support most implementations of guest user access dynamic token/password generation and allow the removal of those users for a guest role.
Note
Support for Single Sign-on (SSO) with Cisco Airespace Wireless LAN Controller
Cisco Clean Access release 3.5(8) extends RADIUS Accounting support for Single Sign-On (SSO) to include the Cisco Airespace Wireless LAN Controller. The Clean Access Server can acquire the client's IP address from either Calling_Station_ID or Framed_IP_address RADIUS attributes for SSO purposes. For SSO to work with Cisco Clean Access, the Cisco Airespace Wireless LAN Controller must send the Calling_Station_IP attribute as the client's IP address (as opposed to the Framed_IP_address attribute that the VPN concentrator uses).
Cisco Clean Access OOB Support for Catalyst 4000
Release 3.5(8) adds out-of-band switch management support for the Cisco Catalyst 4000.
Clean Access Agent Enhancements (3.5.10)
Version 3.5.10 of the Clean Access Agent resolves caveats CSCsc44051 (antivirus) and CSCsc44335 (uninstall). See Resolved Caveats - Release 3.5(8) for details or Enhancements per Agent Version.
Supported AV Product List
The Supported AV Product List remains at Version 20. There are no enhancements for release 3.5(8).
See Clean Access Supported Antivirus Product List and Supported AV Product List Versions for information on previous versions.
Enhancements for Release 3.5(7)
This section details enhancements to existing features delivered with release 3.5(7) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
See also Resolved Caveats - Release 3.5(7).
OOB Support for Cisco Catalyst 5500, 2960 Series Switches
Release 3.5(7) adds out-of-band switch management support for the following switches:
•
•
Note
See also Supported Switches for Cisco Clean Access.
OOB Virtual Gateway Enhancements
For OOB Virtual Gateway mode, there is a new option in the Port Profile to prevent the switch port from being bounced when:
•
•
Instead, the port VLAN will be changed to the Authentication VLAN.
This option is intended to prevent bouncing of a switch port when a client machine is connected to the switch port through a VoIP phone. The feature allows Cisco Clean Access to authenticate/assess/ quarantine / remediate a client machine (laptop/desktop) without affecting the operation of a VoIP phone connected to the switch port. This enhancement results in a new option "Remove Out-of-Band online user without bouncing the port" added to following pages:
•
Discovery Host Field
The "CAS Discovery Host" field is renamed to Discovery Host on the following web console page:
•
NAT Gateway Notification
Administrators will be shown the following notification when choosing NAT Gateway or Out-of-Band NAT Gateway for the operating mode of a CAS: "NAT Gateway is only recommended for demo/testing purposes. For production deployments, Virtual or Real-IP Gateway is recommended." This affects the following web console page:
•
Enhanced Security
Starting with release 3.5(7), the Clean Access Manager web console requires high encryption (64 or 128 bit) and does not accept 56-bit encryption. See Web Browser Compatibility.
Clean Access Agent Enhancements (3.5.9)
For in-band configurations, release 3.5(7) of Cisco Clean Access with version 3.5.9 of the Agent provides a new option to enable/disable the Clean Access Agent from logging the user off the Clean Access system when the user logs off from the Windows domain or shuts down the Windows workstation. This allows the administrator to configure whether or not logged-in users remain logged into the network when the machine is shut down/restarted. Note that:
•
•
•
Note
•
•
This enhancement results in a new checkbox for "Logoff Clean Access Agent users from network on their machine logoff or shutdown" added to the following web console page:
•
See also Clean Access Agent Enhancements (3.5.8) and Enhancements per Agent Version.
Supported AV Product List (Version 20)
•
•
Enhancements for Release 3.5.6.1
Release 3.5.6.1 is a general and important bug fix release and patch for the Clean Access Manager and Clean Access Server. No new features are added.
Warning
Note
•
•
•
Information for the 3.5.6.1 patch is in the following sections:
•
•
Upgrade Instructions for 3.5.6.1
Please execute the steps for the following patch update procedures on your CAM and CAS.
•
•
3.5.6.1 Patch Upgrade Procedure for CAM
Carefully execute the following patch update procedure on your CAMs. After the steps are completed, the database of the current active CAM will be propagated to both CAMs, and the CAMs will be in sync.
Step 1
Step 2
Step 3
Step 4
tar -xzf cca-3.5.6-to-3.5.6.1-upgrade.tar.gzStep 5
cd cca_upgrade_3.5.6.1Step 6
./UPGRADE.shStep 7
Step 8
Step 9
Step 10
service perfigo restartStep 11
service perfigo restartStep 12
3.5.6.1 Patch Upgrade Procedure for CAS
Step 1
Step 2
–
–
Enhancements for Release 3.5(6)
This section details enhancements to existing features delivered with release 3.5(6) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
For additional details, see also Clean Access Agent Enhancements and Clean Access Supported Antivirus Product List. For configuration details, refer to the product documentation.
Case Insensitivity for Max Sessions per User Account
The Max Sessions per User Account feature adds a new option for case insensitivity. The Case-Insensitive checkbox (3.5.6 and above) allows the administrator to allow/disallow case-sensitive user names towards the max session count. For example, if the administrator chooses to allow case-sensitivity (box unchecked; default), then jdoe, Jdoe, and jDoe are all treated as different users. If the administrator chooses to disable case-sensitivity (box checked), then jdoe, Jdoe, and jDoe are treated as the same user.
This enhancement results in a new "Case-Insensitive" checkbox added to these web console pages:
•
API Enhancements
With release 3.5(6), the Cisco Clean Access API utility script, cisco_api.jsp, provides two new functions and enhances an existing function.
•
•
•
In addition, the descriptions for addcleanmac, removecleanmac, and removemac have been updated on the cisco_api.jsp page itself, which describes all the available API functions. The Clean Access API for your Clean Access Manager is accessed from a web browser as follows: https://<cam-ip-or-name>/admin/cisco_api.jsp
Nessus Plugin Default View
With release 3.5(6), the default view on the Nessus plugin page is changed from "All" to "Selected." Note that if Nessus plugins have not yet been checked and updated for the user role, the default view (i.e. Selected Plugins) shows no plugins. To select plugins, the administrator must choose one of the other views (for example, "All," "Backdoors," etc.) from the "Show...Plugins" dropdown.
This enhancement results in changes to the following web console page:
•
Clean Access Agent Distribution Enhancements
With release 3.5(6), the Clean Access Agent Distribution page of the CAM web console provides a new option to disable upgrade notifications (mandatory or optional) to 3.5.1+ Agent users, even when a newer Agent update becomes available on the CAM.
Note
Prior to this feature, if an Agent update was available, the user was always shown a prompt, whether the upgrade was optional or mandatory. This additional Distribution option will cause the user not to be informed of an Agent upgrade even if an Agent update is available. Enabling this option in effect prevents distribution of the Agent Patch upgrade to users when a newer Agent is downloaded to the CAM.
This enhancement results in the following change to the web console:
•
See also Clean Access Agent Enhancements for additional details
Clean Access Agent Enhancements (3.5.8)
For in-band configurations, version 3.5.8 of the Clean Access Agent now attempts to log the user off the Clean Access system prior to Windows user logout or Windows shutdown. This enhancement takes effect when the user logs off from the Windows domain (i.e. Start->Shutdown->Log off current user) or shuts down the machine (Start->Shutdown->Shutdown machine). Prior to the 3.5.8 Agent, a logged-in user remained logged into the network when the machine was shut down/restarted.
Note that the attempt to log off from the Clean Access environment may be unsuccessful if the Agent is terminated by Windows prior to successfully logging off from the Clean Access system.
Note
See Clean Access Agent Enhancements for additional details on version 3.5.6 and 3.5.7 of the Clean Access Agent (released post 3.5(5)).
Supported AV Product List (Version 18)
•
•
Enhancements for Release 3.5.5.1
Release 3.5.5.1 is a general and important bug fix release and patch for the Clean Access Manager and Clean Access Server. No new features are added.
Warning
Note
•
•
•
Information for the 3.5.5.1 patch is in the following sections:
•
•
Upgrade Instructions for 3.5.5.1
Please execute the steps for the following patch update procedures on your CAM and CAS.
•
•
3.5.5.1 Patch Upgrade Procedure for CAM
Carefully execute the following patch update procedure on your CAMs. After the steps are completed, the database of the current active CAM will be propagated to both CAMs, and the CAMs will be in sync.
Step 1
Step 2
Step 3
Step 4
tar -xzf cca-3.5.5-to-3.5.5.1-upgrade.tar.gzStep 5
cd cca_upgrade_3.5.5.1Step 6
./UPGRADE.shStep 7
Step 8
Step 9
Step 10
service perfigo restartStep 11
service perfigo restartStep 12
3.5.5.1 Patch Upgrade Procedure for CAS
Step 1
Step 2
–
–
Important Notes for Release 3.5(5)
OOB Switch Management MAC Address Table Aging Time
The MAC address table aging-time must be set to a minimum of 3600 seconds on the switch when mac-notification SNMP traps are used for switch management. For details, see "Example Switch Configuration Steps" in the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
Enhancements for Release 3.5(5)
This section details enhancements to existing features delivered with release 3.5(5) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
•
•
•
•
For additional details, see also Clean Access Agent Enhancements and Clean Access Supported Antivirus Product List. For configuration details, refer to the product documentation.
New Enable/Disable L3 Option on CAS
Release 3.5(3) introduced support for multi-hop L3 in-band deployments, and with release 3.5(3) and 3.5(4), this feature was enabled by default. With release 3.5(5), the administrator has the option of enabling or disabling the L3 feature at the CAS level. L3 capability will be disabled by default after upgrade or new install of 3.5(5), and enabling the feature will require an update and reboot of the Clean Access Server.
To Enable L3 Capability:
1.
2.
3.
Note
To Disable L3 Capability:
To disable L3 discovery of the Clean Access Server at the CAS level for all Clean Access Agents:
1.
2.
3.
To disable L3 discovery of the Clean Access Server for NEW installs of the Clean Access Agent (3.5.3+)
1.
2.
3.
Note
This feature results in the following enhancements to the web console:
•
See Clean Access Agent Enhancements for additional details.
CAS Discovery Host Enhancements
With release 3.5(5), the Clean Access Agent will now send use a proprietary, encrypted, UDP-based protocol, instead of HTTP, to the Clean Access Manager to discover the Clean Access Server. This changes the behavior of the 3.5.5 Clean Access Agent, but does not affect the web console interface or Agent dialogs. See Software Compatibility Matrixes and Clean Access Agent Enhancements for further details.
Clean Access Agent Enhancement (3.5.5)
With release 3.5(5), the Clean Access Agent installer now installs by default for all users on a client machine, as opposed to only the current user.
Note that 3.5.5 Agent will only support multi-hop L3 operation with the 3.5(5) CAM/CAS. L3 discovery will not work with older CAM/CAS versions. See Software Compatibility Matrixes and Clean Access Agent Enhancements for further details.
OOB Switch Management SNMP Receiver Enhancements
Release 3.5(5) enhances the Clean Access Manager SNMP Receiver to support simultaneous use of different versions of SNMP (V1, V2c, V3) when controlling groups of switches in which individual switches may use different versions of SNMP.
This enhancement results in changes to the following web console page:
•
OOB Switch Management Respects Device Filters
With release 3.5(5), the Clean Access Manager now respects the global Device Filters list (under Device Management > Filters > Devices > New) for Out-of-Band deployments. In OOB, the rules configured for MAC addresses on the global Device Filter list will have the highest priority for user/device processing (just as for In-Band deployments). For OOB, the priority of rule processing is as follows:
1.
2.
3.
MAC address device filters configured for OOB have the following options and behavior:
•
•
•
This enhancement results in changes to the following web console page:
•
Automatic Update of Default Host Policies
As a convenience for administrators, Cisco Clean Access will provide updates to default host-based traffic policies for the Unauthenticated, Temporary, and Quarantine user roles.
Note
Updates to default host-based policies for default system user roles will be distributed when an Update or Clean Update is performed from Device Management > Clean Access > Clean Access Agent > Updates. Note that default host policies are disabled by default, and you must enable them for each role. The following default allowed hosts are provided with release 3.5(5):
Microsoft Windows Update
•
•
Symantec AntiVirus Update
•
•
•
McAfee AntiVirus Update
•
•
TrendMicro AntiVirus Update
•
•
This enhancement results in the following changes in the web console:
•
•
Supported AV Product List (Version 17)
•
•
System Upgrade Enhancements
Release 3.5(4) introduced the capability of upgrading the CAM via the CAM web console and the CAS via the CAS web console, as follows:
•
•
Release 3.5(5), installed, will additionally allow for web console upgrade of the CAS via the CAS management pages for future upgrades (e.g. 3.5.6), as follows:
•
Event Log Enhancements
Starting with release 3.5(5), Switch Management events for notifications received by the CAM from switches are no longer written to the event log. They will instead be written only to the logs on the file system (/perfigo/logs/perfigo-log0.log.0). Furthermore, these events are written to disk only when the log level is set to INFO or finer (using the loglevel utility found in /perfigo/control/bin).
Enhancements for Release 3.5.4.1
Release 3.5.4.1 is a general, important bug fix release and patch for the CAS. No new features are added.
The 3.5.6 Clean Access Agent uncovered a hidden bug in the SWISS (CAS discovery) implementation on the Clean Access Server which caused the 3.5.6 Agent not to be able to log into 3.5(4) and prior CASes. This patch resolves this issue and allows 3.5.6 and above Agents to log in. See Resolved Caveats - Release 3.5.4.1, and Clean Access Agent Enhancements for details.
Note
•
•
•
Upgrade Instructions for 3.5.4.1
Use the steps below to apply the 3.5.4.1 patch to each Clean Access Server in your system.
Step 1
Step 2
•
•
•
Upgrade Instructions for 3.5.4.1 CAS Patch via SSH
Step 1
Step 2
cd /storeStep 3
tar xzvf cas-3.5.4-to-3.5.4.1-upgrade.tar.gzStep 4
cd cca_upgrade_3.5.4.1Step 5
./UPGRADE.shStep 6
reboot
Enhancements for Release 3.5(4)
This section details enhancements to existing features delivered with release 3.5(4) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
•
For additional details, see also Clean Access Agent Enhancements and Clean Access Supported Antivirus Product List. For configuration details, refer to the product documentation.
OOB Support for Cisco Catalyst 3500 XL, 2900 XL, 2940 Series Switches
Release 3.5(4) adds out-of-band switch management support for the following switches:
•
•
•
See Supported Switches for Cisco Clean Access for details.
OOB Switch Management Ports Configuration Enhancements
Release 3.5(4) provides a new button option from the web console to make switch configuration changes permanent on the switch. Prior to 3.5(4), the web console only allowed changing the running configuration of the switch and saving the switch configuration had to be done on the switch itself.
This enhancement results in the following modifications to the Switch Management > Devices > Switch [IP address] > Ports page of the web admin console:
•
•
•
–
–
API Support Enhancement
Cisco Clean Access provides a utility script called cisco_api.jsp that allows you to perform certain operations using HTTPS POST. The Clean Access API for your Clean Access Manager is accessed via: https://<cam-ip-or-name>/admin/cisco_api.jsp
This API was originally designed to provide unauthenticated access. However, due to information available through this API, this API will be protected by authentication starting with release 3.5.4. Release 3.5.4 will require authentication over SSL for access to the API. (Note that this also resolves caveat CSCsb48572).
Since it is now necessary to authenticate before accessing the API, this enhancement results in two new authentication methods:
•
This method requires the administrator to create an authentication shell script that will set a cookie with the session ID to be accessed for the rest of the admin session. If a session ID cookie is not set, the user will be prompted to login. This method results in two new functions being added: adminlogin and adminlogout. The administrator login function returns a session ID which has to be set as a cookie for usage of any API. The adminlogout function should then be used to terminate the session. However, if adminlogout is not used, the session will still be terminated by admin session timeout.
•
If the administrator does not want to create a shell script using cookies, this method is provided as an alternative. With this method, authentication is performed every time a function is used. This results in two new optional parameters added to every function: admin, and password. If authenticating by function, you will need to add the admin and password parameters to all functions that you are using in your existing script. In this case, you do not use the adminlogin and adminlogout functions.
Agent-AV Support Info Page Enhancements
Release 3.5(4) further integrates the dynamic AV checking provided with release 3.5(3) (see Dynamic AV Definition Checks) to make this process more transparent for the administrator. Starting with version 3.5.3 and 3.5.4 of the Clean Access Agent, the Agent automatically returns its version number to the Clean Access Manager. This allows the CAM to determine on-the-fly the method of AV checking to perform (version or date) when sending the requested AV definition checks to the Agent.
Note
•
This enhancement modifies the following page of the web admin console:
•
The "Support AV Products for Agent Version []" portion of the page, added for release 3.5(3), is removed for release 3.5(4) as this function is now automatically performed by the CAM going forward.
See also Supported AV Product List Versions.
Supported AV Product List (Version12)
•
•
Clean Access Agent (3.5.4) Auto-Upgrade
With release 3.5(4), the Clean Access Agent will no longer check for newer Agent versions at application startup, and will instead check for Agent updates at every login request. Note that 3.5.1/3.5.2/3.5.3 Agents will still check for Agent updates only at application restart or on client machine reboot.
Note
See Clean Access Agent Enhancements for further details.
System Upgrade Enhancements
Release 3.5(3) introduced the ability to perform software upgrade on the CAM and CAS by uploading the upgrade file in .tar.gz format via the web console. This means with release 3.5(4), you can now upgrade to 3.5(4) via the web console UI. For upgrade instruction details via the web console, see Installing or Upgrading to a New Software Release.
The Clean Access Manager will automatically perform all the upgrade tasks that are currently done manually (for example, create snapshots before and after upgrade, untar file, cd to /store, run upgrade script).
Note
In addition the upgrade process has been enhanced as follows:
•
•
•
•
•
•
These enhancements result in modifications to the following pages in the web admin console:
•
•
Logging Enhancements
Logging enhancements have been made to support Agent AV check implementation.
Enhancements for Release 3.5.3.2
Release 3.5.3.2 is a general, important bug fix release and patch for the CAS. No new features are added.
The 3.5.6 Clean Access Agent uncovered a hidden bug in the SWISS (CAS discovery) implementation on the Clean Access Server which caused the 3.5.6 Agent not to be able to log into 3.5(4) and prior CASes. This patch resolves this issue and allows 3.5.6 and above Agents to log in. See Resolved Caveats - Release 3.5.3.2, and Clean Access Agent Enhancements for details.
Note
•
•
•
Upgrade Instructions for 3.5.3.2
Use the steps below to apply the 3.5.3.2 patch to each Clean Access Server in your system.
Step 1
Step 2
•
•
•
Upgrade Instructions for 3.5.3.2 CAS Patch via SSH
Step 1
Step 2
cd /storeStep 3
tar xzvf cas-3.5.3.1-to-3.5.3.2-upgrade.tar.gzStep 4
cd cca_upgrade_3.5.3.2Step 5
./UPGRADE.shStep 6
reboot
Enhancements for Release 3.5.3.1
Release 3.5.3.1 is a general and important bug fix release and patch for the Clean Access Manager and Clean Access Server. No new features are added.
Note
•
•
•
Without the 3.5.3.1 patch, systems running Cisco Clean Access 3.5.3 might experience service outages with very little load on the systems. Information for the 3.5.3.1 patch is in the following sections:
•
•
Upgrade Instructions for 3.5.3.1
Use the following steps to apply the 3.5.3.1 patch to the CAM and CAS:
Step 1
Step 2
Step 3
cd /storeStep 4
tar xzvf cca-3.5.3-to-3.5.3.1-upgrade.tar.gzStep 5
./cca-3.5.3-to-3.5.3.1-upgrade.shStep 6
service perfigo restart
New Features in Release 3.5(3)
This section details the new additional features delivered with release 3.5(3) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
See also Enhancements for Release 3.5(3) for additional details. For configuration details, refer to the product documentation.
Multi-Hop L3 In-Band Deployment Support
Release 3.5(3) of Cisco Clean Access enables administrators to deploy the Clean Access Server (CAS) in-band behind a VPN concentrator, or router, or multiple routers. Prior to 3.5(3), Clean Access Server(s) needed to be deployed either as a bridge (Virtual Gateway) or first-hop default gateway with Layer 2 proximity to users, in order for user MAC addresses to be visible to the CAS. Release 3.5(3) adds the capability of multi-hop Layer 3 in-band deployment by allowing the Clean Access Manager (CAM) and CAS to track user sessions by unique IP address when users are separated from the CAS by one or more routers. Note that you can have a CAS supporting both L2 and L3 users. With layer 2-connected users, the CAM/CAS continue to manage these user sessions based on the user MAC addresses, as before.
For users that are one or more L3 hops away, note the following considerations:
•
•
•
•
•
•
Note that when the Single Sign-On (SSO) feature is configured for multi-hop L3 VPN concentrator integration, if the user's session on the CAS times out but the user is still logged in on the VPN concentrator, the user session will be restored without providing a username/password.
•
Note that the HeartBeat Timer will work if the CAS is the first hop behind the VPN concentrator. This is because the VPN concentrator responds to the ARP queries for the IP addresses of its current tunnel clients.
This new feature results in the following enhanced page in the web admin console:
•
VPN Integration and Single Sign-On (SSO)
In addition to being deployable with VPN concentrators, Cisco Clean Access provides the best user experience possible for Cisco VPN concentrator users through Single Sign-On (SSO). Users logging in through the VPN Client do not have to login again to Cisco Clean Access. Cisco Clean Access leverages the VPN login and any VPN user group/class attributes to map the user to a particular role.
This level of integration is achieved using RADIUS Accounting with the Clean Access Server acting as a RADIUS accounting proxy.
Release 3.5(3) of Cisco Clean Access supports the following VPN clients for the purposes of Single Sign-On:
•
•
See VPN Components Supported for Single Sign-On for details.
This new feature results in the following new pages or enhancements in the web admin console:
•
•
•
System Upgrade via Web Console (3.5(3) and Above)
Going forward from version 3.5(3) of the Cisco Clean Access software, administrators will be able to perform software upgrade on the CAM and CAS by uploading the upgrade file in .tar.gz format via the web console. The Clean Access Manager will automatically perform all the upgrade tasks that are currently done manually (for example, create snapshots before and after upgrade, untar file, cd to /store, run upgrade script).
Note
The software upgrade pages have a new Shutdown button that shuts down the service on the box without shutting down the box itself (equivalent to the service perfigo stop command). To restart the service, use the service perfigo restart or reboot command from a command shell. The software upgrade pages now also display how many upgrades have been done, and the list of upgrades and logs from each. Upgrade Logs are the same as a stdout from a manual upgrade, and Upgrade Details display a list of actions performed by the upgrade for the purpose of customer support troubleshooting.
This new feature results in the following enhanced pages in the web admin console:
•
•
Automated Daily Database Backups
Starting with 3.5(3), Cisco Clean Access automatically creates daily snapshots of the Clean Access Manager database and preserves the most recent from the last 30 days. It also automatically creates snapshots before and after software upgrades, and before and after failover events. For upgrades and failovers, only the last 5 backup snapshots are kept.
Database Recovery Tool
The Database Recovery tool is a new command line utility (3.5.3+) that can be used to restore the database from the following types of backup snapshots:
•
•
•
•
Although the web console already allows you to manually create and upload snapshots (via Administration > Backup), the CLI tool presents additional detail. The tool provides a menu that lists the snapshots from which to restore, and the uncompressed size and table count. Note that a file which is corrupt or not in the proper format (e.g. not .tar.gz) will show a remediation warning instead of an uncompressed size and a table count.
Once the administrator confirms the restore, the database is replaced with the chosen snapshot.
Caution
To run the command utility:
1.
2.
3.
4.
5.
6.
7.
Support Logs
There are two new Support Logs web console pages for the CAM and CAS to facilitate TAC support when a customer has issues. The Support Logs page allows administrators to combine a variety of system logs (such as information on open files, open handles, and packages) into one tarball that can be sent to TAC to be included in the support case. Administrators should download these support logs when sending their customer support request.
This feature results in the following new pages in the web admin console:
•
•
Enhancements for Release 3.5(3)
This section details enhancements to existing features delivered with release 3.5(3) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
See also New Features in Release 3.5(3) for additional details. For configuration details, refer to the product documentation.
Upgrade Script Enhancements
The upgrade script for release 3.5(3) now enables direct upgrades to 3.5(3) from 3.2(x) and 3.3(x) in addition to 3.4(x), and previous 3.5(x) releases. See Installing or Upgrading to a New Software Release for specific instructions.
Dynamic AV Definition Checks
Cisco Clean Access flexibly allows multiple versions of the Clean Access Agent to be used on the network. Each new version of the Clean Access Agent adds support for the latest AV products as these products are released. With release 3.5(3) of Cisco Clean Access, the system picks the best method to execute AV definition checks based on the AV product support at the time of execution.
This dynamic AV definition checking means the Clean Access Manager will now decide at runtime, based on the supported AV product list, whether to use the virus definition date or version to execute AV Rule checks. This frees the customer from having to reconfigure AV rules when the check method changes based on updates to the AV support chart.
Previous to 3.5(3), the use of virus definition date or version in executing checks for AV Definition Rules was determined at the time of rule configuration. This required customer reconfiguration of AV Rules when checking methods changed with the supported AV product list updates.
Because Cisco Clean Access allows concurrent use of multiple Agent versions, a new page has been added to web console that details AV product/version support per Clean Access Agent version. It is intended to help the administrator pinpoint AV product version support in order to troubleshoot failed AV definition requirements on clients in environments where multiple Agent versions are deployed.
Note that you must configure Mandatory Agent upgrade on clients to ensure latest AV product support.
Warning
The dynamic AV definition check feature results in the following enhancements to the web admin console:
•
•
AV Support Changes
Note
Customers running release 3.5(0), 3.5(1), or 3.5(2) who configured AV Definition Update Rules for the following products will need to perform a Clean Update to get the latest AV product list and reconfigure any existing AV definition rules based on these products:
•
•
•
•
You can perform a Clean Update under Device Management > Clean Access > Clean Access Agent > Updates to get the latest Supported AV Product list.
AV virus definition rules are not supported for Computer Associates eTrust EZ Antivirus 6.1.x and eTrust EZ Armor 6.1.x products (although AV installation rules are supported). AV virus definition rules for the specified Panda and Sophos products are supported but require a Clean Update of the supported AV list to correct the version numbering information and a reconfiguration of any existing rules for these products.
See Supported AV Product List Versions for details.
Supported AV Product List (Version 9)
Version 9 of the Supported AV list resolves a number of bugs including McAfee Engine 9.x version fix (CSCei46351) and BitDefender definition date issue (CSCei46336). See the following for details:
•
•
•
Clean Access Agent (3.5.3)
Version 3.5.3 of the Clean Access Agent incorporates support for the multi-hop L3 deployment feature.
VPN/L3 access from the Clean Access Agent is only supported with the 3.5.3 (or above) Agent.
In order for clients to discover the Clean Access Server when they are one or more L3 hops away, the 3.5.3 (or above) Clean Access Agent must be initially installed by being downloaded from the CAS. This can be done in two ways:
•
•
Either method provides clients with the CAM information needed for subsequent logins when users are one or more L3 hops away from the CAS. Acquiring and installing the 3.5.3 Agent by other means than direct download from the CAS (for example, Cisco Downloads) will not provide the necessary CAM information to the Agent and will not allow those Agent installations to operate in a multi-hop Layer 3 deployment.
See Clean Access Agent Enhancements for further details.
Note
Warning
Enhancements for Release 3.5.2.2
Release 3.5.2.2 is a general and important bug fix release and patch for the Clean Access Server. No new features are added.
The 3.5.6 Clean Access Agent uncovered a hidden bug in the SWISS (CAS discovery) implementation on the Clean Access Server which caused the 3.5.6 Agent not to be able to log into 3.5(4) and prior CASes. This patch resolves this issue and allows 3.5.6 and above Agents to log in. See Resolved Caveats - Release 3.5.2.2, and Clean Access Agent Enhancements for details.
Note
•
•
•
Upgrade Instructions for 3.5.2.2
Use the steps below to apply the 3.5.2.2 patch to each Clean Access Server in your system.
Step 1
Step 2
•
•
Upgrade Instructions for 3.5.2.2 CAS Patch via SSH
Use the following steps to apply the 3.5.2.2 patch to each Clean Access Server in your system:
Step 1
Step 2
cd /storeStep 3
tar xzvf cas-3.5.2-to-3.5.2.2-upgrade.tar.gzStep 4
cd cca_upgrade_3.5.2.2Step 5
./UPGRADE.shStep 6
reboot
Enhancements for Release 3.5.2.1
This section describes enhancements for the 3.5.2.1 release and patch for the Cisco Clean Access Manager:
•
•
•
For additional details, see also Clean Access Agent Enhancements and Supported AV Product List Versions. For configuration details, refer to the product documentation.
Overview
Release 3.5.2.1 is a general and important bug fix release and patch for the Clean Access Manager. No new features are added. If you are running release 3.5(2) and using ANY AV definition rules, install the 3.5.2.1 patch. Without the patch, you will not be able to get updates of vendors' definition version/date for ANY definition rules by Update or Auto-Update. You will only be able to get the definition version/date update for ANY definition rules by performing periodic Clean Updates. Note that version-specific (non-ANY) AV definition rules and other checks and rules are not affected.
For further details, see:
•
•
•
–
–
–
–
•
3.5.2.1 Update/Upgrade Matrix
Table 5 explains what action is needed depending on the version of Clean Access being run.
Supported AV Product List (Version 8)
•
•
Upgrading from 3.5(2) to 3.5.2.1
Release 3.5.2.1 was a general and important interim bug fix release and patch to be installed on the 3.5(2) Clean Access Manager only. If running release 3.5(2), and using ANY AV definition rules, install the 3.5.2.1 patch. See Enhancements for Release 3.5.2.1 and 3.5.2.1 Update/Upgrade Matrix for further details.
Note
•
•
To upgrade from Cisco Clean Access Manager 3.5(2) to 3.5.2.1 follow the instructions below:
Step 1
Step 2
Step 3
tar zxvf <filename>Step 4
sh ./<filename.sh>Step 5
service perfigo restart
Enhancements for Release 3.5(2)
This section describes enhancements for the 3.5(2) release:
•
Licensing Changes
As of release 3.5(2), customers with Out-of-Band (OOB) licenses can add In-Band (IB) Clean Access Servers to the Clean Access Manager. Note that you must have an OOB license to enable Out-of-Band features and Clean Access Servers.
AV Enhancements
If an AV Definition Update requirement with "ANY" vendor is used, then only the first AV product in the discovered AV list is updated. Hence, if a machine has multiple AV products installed, all the AV products are detected but only the first AV product will be updated. Note that the "ANY" feature is mainly intended to support the validation of machines with a single AV product installed where the vendor is unknown (e.g. guest access, visitor access), as opposed to situations with a single machine having more than one AV installed.
In 3.5(1) when mapping AV Definition Update requirements to rules on the Rules-Requirement page, only AV definition rules for the applicable vendor were shown. This meant AV definition rules could only be mapped to the AV Definition Update requirement type. The AV Definition Update requirement allows the user to update client virus definition files via the Clean Access Agent by clicking the "Update" button when the requirement is not met (virus definition files are not up-to-date). In 3.5(2), the Rules-Requirement page displays all rules by applicable client operating system only and does not filter out non-AV definition rules for the AV Definition Update requirement type. This allows mapping AV definition rules to other requirement types (such as File or Link Distribution) in cases where AV definition update will not be performed directly via the Agent on the client. Note that AV installation rules continue to be mapped to Link Distribution, File Distribution, or Local Check requirement types.
See also Supported AV Product List Versions for further details.
Supported AV Product List (Version 7)
•
•
Clean Access Agent (3.5.2)
Version 3.5.2 of the Clean Access Agent clarifies some messages in the installation setup dialogs from 3.5.1. The 3.5.2 Clean Access Agent also incorporates the auto-upgrade feature (available as of release 3.5.1). When Auto-Upgrade is configured in the Clean Access Manager, clients running the 3.5.1 Agent can automatically upgrade to the 3.5.2 Agent. See Clean Access Agent Enhancements for additional details.
Known Issues for Release 3.5(2)
If you created AV Definition Update Rules in release 3.5(0) or 3.5(1) (whether ANY or vendor-specific) for the following vendors and client operating systems, after upgrading to release 3.5(2), you will need to edit and save such rules before they can be used. This issue does not affect new AV Definition Update rules that are created after updating to version 8 of the supported AV list.
Note that this only affects AV definition updates for the specified vendor and client OS.
•
•
See caveat CSCei10529 for details. See also Supported AV Product List Versions
New Features in Release 3.5(1)
This section details new additional features delivered with release 3.5(1) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
For configuration details, refer to the product documentation.
Clean Access Agent Auto-Upgrade (3.5.1)
With release 3.5(1), Cisco Clean Access introduces easy, on-the-fly auto-upgrade of deployed Clean Access Agent client software. Whenever a newer version of the Agent is available, the running Clean Access Agent informs the user and automatically performs the upgrade, relieving the administrator and end-user of the chore of manually downloading the new Agent, uninstalling the previous Agent, and installing the new Agent. The Clean Access Manager (CAM) automatically fetches new Agent updates (or Agent patches, bug fixes, and so on) from a centralized remote site and automatically deploys the updated Agent to all the managed Clean Access Servers (CASs) without administrator intervention. In addition, administrators can make the Agent upgrades mandatory (end-user has no choice but to update) or optional (end-user can choose to upgrade immediately or later).
Note
Once version 3.5.1 of the Clean Access Agent is installed on clients, it will automatically detect when a Agent upgrade is available (3.5.2 or above), download the Agent upgrade from the Clean Access Server, and upgrade itself on client systems. Users will see a confirmation prompt to start the auto-upgrade — OK (mandatory upgrade), or Yes (non-mandatory upgrade)
To upgrade from 3.5.0 or below, users must manually install the Agent. However, the new installer for the 3.5.1 Agent makes the process simpler for users than before and does not need to be executed twice (once to remove, second time to install). The 3.5.1 installer auto-detects if a previous version of the Clean Access Agent is installed, removes the old version and installs the new version in one pass. It is also capable of shutting down the previous version of the application if it is running on the client during upgrade. See Upgrading Agent to 3.5.1 for further details.
The new Auto-Upgrade feature results in the following enhancements to the web admin console:
•
•
The Clean Access Agent installs to C:\Program Files\Cisco Systems\Clean Access Agent\ on the client.
See Clean Access Agent Enhancements for additional details.
Clean Access Agent Displays VPN Information (3.5.1)
The Clean Access Agent now displays the same VPN information that is currently available to VPN-connected web login users via the logout page. When an Optional or Enforce VPN Policy is configured for the Clean Access Server (CAS) and/or user role, VPN information appears in a separate dialog to Clean Access Agent users. The VPN Info dialog is available both from a link in the Successful Login dialog, and by right-clicking the "Show VPN Info" option from the system tray taskbar menu.If available, VPN server, IPSec Key, PPP ID, and PPP Key information will be displayed.
Login Session Limit
This new feature allows administrators to limit the number of login sessions per user ID to a configured maximum for the user role. If the user exceeds this limit, the user is alerted on the web login page or Clean Access Agent dialog and prompted to remove the oldest session before re-logging in. A warning message "Too many users using this account" appears and the user can either log in as a different user or check an option to remove the oldest user login session.
This new feature results in the following enhancements to the web admin console:
•
Ability to Assign Original VLAN to Authenticated/Certified Devices on Out-of-Band Ports
This new feature allows administrators to switch Out-of-Band clients back to the initial VLAN after authentication and certification of a device. The initial VLAN is the value saved for the port by the Clean Access Manager when the switch is added. Instead of specifying an Access VLAN, the client is switched from the initial VLAN to an Auth VLAN for authentication and certification, then switched back to the initial VLAN when the client is certified.
This new feature results in the following enhancements to the web admin console:
•
•
Ability to Specify Complex Auth Server Mapping Rules
This new feature allows the administrator to specify complex boolean expressions when defining mapping rules for Kerberos, LDAP, and RADIUS authentication servers. You can use boolean expressions to combine multiple user attributes and multiple VLAN IDs to map users to user roles. Mapping rules can be created for a range of VLAN IDs, and attribute matches can be made case-insensitive. This allows multiple conditions to be flexibly configured for a mapping rule.
This new feature results in the following enhancements to the web admin console:
•
Enhancements for Release 3.5(1)
This section describes enhancements for release 3.5(1) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
•
Upgrade Script Enhancement
The 3.5 upgrade script is now modified to perform 3.5(1) upgrades and 3.4(x) upgrades. The upgrade script also incorporates a DHCP script which regenerates all ARP entries upon upgrade. This DHCP script is an upgrade-time enhancement to account for a resolved caveat (CSCeh31769) that might have caused deletion of some DHCP-related ARP entries from the database in certain cases.
Event Log Simplified for Rule Auto-Updates
With 3.5(1), checks and rules modified from auto-update are condensed into a single event log entries. This enhancements results in following modification to the web admin console:
•
Clean Access Agent Rule Categorization
Display and usability is improved by categorizing the display of rules on the Clean Access Agent rule and requirement configuration pages. The UI is made more intelligent by only showing AV definition rules when displaying AV definition requirements.
Enhancement to AV Definition Rules and Requirements
Starting with version 3.5.1 of the Clean Access Agent, there is a new "ANY" Antivirus Vendor category available on the configuration pages for New/Edit AV Rule and New/Edit AV Definition Update Requirement. This enhancement allows the administrator to create a single AV definition rule to check for antivirus definition files for any supported vendor. Additionally, you can now select "ANY" Antivirus Vendor when configuring an AV Definition Update requirement. When mapping AV definition rules to an AV Definition Update requirement configured for ANY vendor, this displays the "ANY" vendor AV definition rules as well as those configured for individual vendors and products. Note that while AV definition rules are mapped to AV Definition Update requirements, AV installation rules are mapped to requirements of type Link Distribution, File Distribution, or Local Check.
This enhancement results in the following modifications to the web admin console:
•
•
•
See also Clean Access Supported Antivirus Product List.
Supported AV Product List (Version 6)
•
•
Supported Out-of-Band Switches List Updated
Support for the Cisco Catalyst 3560 switch is now added for release 3.5(1) OOB. See Supported Switches for Cisco Clean Access.
New Features in Release 3.5(0)
This section details the new features delivered with release 3.5(0) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
For configuration details, refer to the product documentation.
Switch Control-Based Out-of-Band (OOB) Product Module
With release 3.5, Cisco Clean Access expands its capabilities to provide a choice of out-of-band deployment and/or traditional in-band deployment. The Cisco Clean Access Manager (CAM) can manage both in-band Clean Access Servers and out-of-band Clean Access Servers at the same time, as well as switches used for out-of-band deployment.
This is a new product offering that requires the purchase of an Out-of-Band (OOB) Clean Access Server (CAS). When you import an OOB CAS license following the purchase of an OOB CAS, the CAM web admin console automatically displays an additional module menu for Switch Management.
In the Cisco Clean Access in-band solution, the CAS is deployed inline with user traffic. The CAS can be deployed in Virtual Gateway configuration between the layer 2 and layer 3 devices on the network edge, or in Real-IP Gateway or NAT Gateway configuration as the first layer-3 hop at the network edge. Inline deployment has the advantage of providing fine-grained control of user traffic, access, and bandwidth.
If it is preferable not to deploy the CAS inline with user traffic after client assessment and certification, the new Cisco Clean Access Out-of-Band (OOB) product provides customers with three additional deployment modes: out-of-band Virtual Gateway, out-of-band Real-IP Gateway, and out-of-band NAT Gateway. With out-of-band deployment, user traffic is directed to the CAS only during the process of initial authentication, posture assessment, and remediation. Following the certification of the device based on the network access policy, user traffic no longer flows through the CAS until the time that the user machine needs to be authenticated/certified again.
Out-of-band deployment is achieved by using the CAM to control switches on the network edge using SNMP. SNMP v1, v2c and v3 are supported for maximum compatibility and security. The CAM uses SNMP to assign/change the VLAN setting on switch ports thereby routing the traffic to the CAS or away from the CAS as needed.
Currently, the OOB product includes support for the following Cisco switches:
•
•
•
•
•
For further details, see Supported Switches for Cisco Clean Access.
In addition to the new Switch Management module, the new OOB product results in the addition of the following three new Server Types in the Add New Server page of the web admin console (Device Management > CCA Servers > New Server):
•
•
•
The new OOB product also results in the addition of an Out-of-Band Users list in the Monitoring > Online Users > View Online Users > Out -of-Band page on the web admin console. The Out-of-Band Users list contains a list of all the users that authenticated to the network through an Out-of-Band Clean Access Server.
For details, see Chapter 4, "Switch Management and Cisco Clean Access Out-of-Band (OOB)" of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
Anti-Virus Software Integration
With release 3.5, Cisco Clean Access expands and adds new Clean Access Agent-based support for the detection of Anti-Virus (AV) software and subsequent checking of AV application status and virus definition status. This is achieved through communicating with the installed AV software (if there is any installed AV software) through an API on the client device.
This new mode of direct communication between the Clean Access Agent and the AV software allows Cisco Clean Access to support many more AV vendors and versions and also enables the Agent to perform auto-update of AV virus definitions for several supported AV products. The hourly updates of Cisco Clean Access checks/rules now reflects the latest published virus definitions of most AV vendors including Symantec, McAfee, TrendMicro, Sophos Panda, Softwin (BitDefender) and others. For further details, see Clean Access Supported Antivirus Product List.
The new AV integration results in the following enhancements to the web admin console:
•
•
•
For details, see the "Clean Access Agent" chapter of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
SNMP Agent Monitoring Services
New SNMP monitoring support in release 3.5 (Monitoring > SNMP) enables the Cisco Clean Access Manager to be monitored from an existing SNMP manager such as HP OpenView, Sun Enterprise Manager, and others. It also provides the capability for the Clean Access Manager to alert the SNMP manager through SNMP traps. However, note that for non-basic monitoring / reporting / configuration / management, the administrator will still have to use the web admin console of the Clean Access Manager.
For details, see the "Monitoring" chapter of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
FlexLM Integration
Release 3.5 introduces a new licensing mechanism based on the industry leading FlexLM license manager product. This allows for the support of flexible licensing schemes.
Release 3.5 also introduces a new license status page in the web admin console (Administration > CCA Manager > Licensing) which allows administrators to install licenses, view the set of features associated with FlexLM licenses, and remove all FlexLM licenses.
For details, see the "Introduction" and "Administration" chapters of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
Enhancements from Release 3.4
This section describes enhancements to features from release 3.4 that are delivered with release 3.5(0) of the Cisco Clean Access Manager and Cisco Clean Access Server.
•
•
•
•
•
RADIUS Accounting Enhancements
RADIUS Accounting is modified in release 3.5 so that the Clean Access Manager sends a Start accounting message on user login and a Stop accounting message on user logout (instead of sending Accounting-on and Accounting-off messages).
RADIUS Accounting has been made highly configurable in release 3.5 (User Management > Auth Servers > Accounting). Prior to this release, RADIUS accounting was limited both in the information that was sent to the accounting server, and the formatting of that information. Release 3.5 greatly improves this by allowing the administrator to configure the kinds of events/data to be sent to the accounting server on user login/logout. It also allows the administrator to customize the formatting of that information to suit specific needs.
For details, see the "User Management: Auth Servers" chapter of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
Network Scanning Enhancements
The Device Management > Network Scanner > Scan Setup > Test page is enhanced with a Show Log button that brings up a debug log for the target computer tested (sourced from /var/nessus/logs/nessusd.messages). The log shows which plugins were executed, the results of the execution, which plugins were skipped and the reason (dependency, timeout, etc). Administrators can check this log to debug why a scan result is not as expected.
The "Automatic Update" option under Device Management > Network Scanner > Plugin Updates is removed. Due to a licensing requirement by Tenable, Cisco will no longer be able to bundle pre-tested Nessus plugins or automated plugin updates to Cisco Clean Access, effective Release 3.3.6/3.4.1. Customers can still download Nessus plugins selectively and manually through http://www.nessus.org. For details on Nessus plugin feeds, see http://www.nessus.org/plugins/index.php?view=feed.
For details, see the "Network Scanning" chapter of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
Clean Access Agent Configuration Enhancements
The Clean Access Manager automatically publishes the Clean Access Agent to all Clean Access Servers. As a result, the "Select Clean Access Servers to Publish the Clean Access Agent" checkbox is removed from Device Management > Clean Access > Clean Access Agent > Distribution.
Verification of Clean Access Agent rules and requirements is now performed automatically and the "Verify All" button and "Verify" icon next to each entry in the Clean Access Agent Rule List and Requirement List have been removed and replaced with a Validity column which displays the integrity status of the rule or requirement. Blue checks in the column indicate the rule or requirement is valid and red crosses indicate the rule or requirement needs to be reconfigured. Highlighting either icon with the mouse pointer displays the validity message.
The following pages of the web administration console are modified accordingly:
•
•
For details, see the "Clean Access Agent" chapter of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
Clean Access Agent Dialog Enhancements (3.5.0)
The taskbar menu for the Clean Access Agent is modified to enable the Login option only if a Clean Access Server is detected by the Agent. If a CAS is not detected, the Agent does not allow the user to attempt a login.
For details, see Clean Access Agent Enhancements and 3.5.0 Agent and Below. See also the "Clean Access Agent" chapter of the Cisco Clean Access Manager Installation and Administration Guide, Release 3.5.
Clean Access Server Proxy Settings
You can configure additional ports (for example, 3128, 8080, 8000, 6588, 3382, 3127) from which to redirect proxied HTTP requests to the login page from Device Management > Clean Access Servers > IPaddress > Advanced > Proxy.
For details, see Chapter 4, "Clean Access Server Managed Domain" of the Cisco Clean Access Server Installation and Administration Guide, Release 3.5.
Clean Access Agent Enhancements
This section provides information for the Clean Access Agent client software:
•
•
•
•
•
Enhancements per Agent Version
Table 6 lists the latest enhancements per version of the Clean Access Agent. Unless otherwise noted, enhancements are cumulative and apply both to the version introducing the feature and to later versions. See also Software Compatibility Matrixes for additional details.
Table 6 Clean Access Agent Versions
3.5.13
•
•
See also Clean Access Agent Enhancements (3.5.13).
3.5.12
•
•
See also Clean Access Agent Enhancements (3.5.12).
3.5.11
•
•
•
•
See Resolved Caveats - Release 3.5(9), Enhancements for Release 3.5(9), and Known Issue for Symantec/Norton Products (3.5.11)
3.5.10
Resolves caveats CSCsc44051 (antivirus) and CSCsc44335 (uninstall)
See Resolved Caveats - Release 3.5(8) and Enhancements for Release 3.5(8).
3.5.9
•
•
Important Notes:•
•
•
See also Enhancements for Release 3.5(7).
3.5.8
•
•
Note
Important Notes:•
•
See also Enhancements for Release 3.5(6).
3.5.7
Enhancement for AV Rule support (McAfee Enterprise 8.0 virus def updates; see caveat CSCsb79391).
Important Notes:•
•
3.5.6
3.5.6 Agent optimizes discovery in multi-hop L3 deployments for release 3.5(5)
Important Notes:3.5.6/3.5.7 Agents are only compatible with 3.5.5/3.5.4.1/3.5.3.2/3.5.2.2 CAM/CAS. For further details, see:
•
•
•
3.5.5
•
•
•
See Enhancements for Release 3.5(5) and VPN/L3 Access for Clean Access Agent (3.5.3+).
Important Notes:3.5.5+ Agents only support multi-hop L3 operation with 3.5(5)+ CAM/CAS. L3 discovery will not work with older CAM/CAS versions.
3.5.4
Agent now checks for newer Agent upgrades at every login request instead of at application startup. See Enhancements for Release 3.5(4).
3.5.3
•
•
Important Notes:3.5.1/3.5.2/3.5.3 Agents check for auto-upgrade only at Agent restart or client reboot.
3.5.2
Agent clarifies some messages in the installation setup dialogs (from 3.5.1). See Enhancements for Release 3.5(2).
Important Notes:3.5.1/3.5.2/3.5.3 Agents check for auto-upgrade only at Agent restart or client reboot.
3.5.1
•
•
Important Notes:•
•
3.5.0
Agent taskbar menu only enables the Login option if a CAS is detected by the Agent.
Important Notes:•
•
VPN/L3 Access for Clean Access Agent (3.5.3+)
Releases 3.5(3) and above of the CAM/CAS/Agent introduce support for multi-hop L3 deployment. VPN/L3 access from the Clean Access Agent is only supported with the 3.5.3+ Agent.
Starting with release 3.5(3)+ of the CAM/CAS/Agent, the Agent will:
1.
2.
In order for clients to discover the CAS when they are one or more L3 hops away, clients must initially download the 3.5.3+ Agent from the CAS (via download web page or auto-upgrade). Either method allows the Agent to acquire the IP address of the CAM in order to send traffic to the CAM/CAS over the L3 network. Once installed in this way, the Agent can be used for both L3/VPN concentrator deployments or regular L2 deployments.
Acquiring and installing the 3.5.3+ Agent on the client by means other than direct download from the CAS (e.g. from Cisco Downloads) will not provide the necessary CAM information to the Agent and will not allow those Agent installations to operate in a multi-hop Layer 3 deployment.
To support VPN/L3 Access, you must:
•
•
Note
•
•
–
–
•
Note
•
•
Clean Access Agent Auto-Upgrade (3.5.1+)
Auto-Upgrade of the Agent is available starting with release 3.5(1) of the CAM/CAS/Agent.
Once the 3.5.1+ Agent is installed on clients, it automatically detects when an Agent upgrade is available (3.5.2+), downloads the upgrade from the CAS, displays a user confirmation prompt, and upgrades itself on the client. Administrators can make Agent Auto-Upgrade mandatory or optional for users.
With upgrade to 3.5(6) CAM/CAS, the Clean Access Agent Distribution page provides a "Do not offer current Clean Access Agent Patch to users for upgrade" option to prevents upgrade notifications to all 3.5.1+ users (mandatory or optional), when an Agent update becomes available on the CAM. Enabling this option in effect prevents distribution of the Agent Patch upgrade to users when a newer Agent is downloaded to the CAM.
Note
This section describes the following:
•
•
•
•
Enabling Agent Auto-Upgrade on the CAM
To enable Auto-Upgrade of the Clean Access Agent on clients, you must:
1.
2.
3.
Note
Disabling Agent Patch Upgrade Distribution to Users
With the 3.5(6)+ CAM/CAS, you can disable notification (therefore distribution) of the Agent Patch upgrade to users as follows:
1.
2.
3.
4.
Enabling Mandatory Auto-Upgrade on the CAM
New installs of the 3.5(3)+ CAM/CAS automatically enable mandatory Auto-Upgrade by default. For CAM/CAS upgrades, the current setting (enabled or disabled) will be carried over to the upgraded system. To enable/disable mandatory Agent Auto-Upgrade for all users:
1.
2.
3.
4.
Caution
User Experience for Auto-Upgrade
With Agent auto-upgrade (and patch distribution) enabled in the CAM, the user experience is as follows:
•
•
•
•
•
–
–
•
Uninstalling the Agent
The Clean Access Agent can be uninstalled on the client from either:
•
•
The 3.5.1+ Agent installs to C:\Program Files\Cisco Systems\Clean Access Agent\ on the client.
The 3.5.0 Agent installs to C:\Program Files\Cisco\Clean Access\ on the client.
(Version 3.3 and below of the SmartEnforcer install to C:\Program Files\Perfigo\SmartEnforcer\)
Agent Setup vs. Agent Upgrade Files
Clean Access Agent Auto-Upgrade (3.5.1 and above) introduces a distinction between the Agent Setup version and the Agent Upgrade (or Patch) version of the client installation files. These reflect the two installers of the same Agent that are used under different conditions:
•
Used for fresh installs on clients that do not have a previous version of the Agent already installed. Users download the Agent Setup file from the "Download Clean Access Agent" page after an initial one-time web login.•
Downloaded by an already-installed Clean Access Agent (i.e. older version) to upgrade itself. Users are prompted to download the Agent Upgrade file after user login (3.5.4+) or after restart of the Agent or PC reboot (3.5.1/3.5.2/3.5.3).Loading Agent Installation Files to the CAM
The Agent Setup or Upgrade file is placed on the CAM as described below. Once either of these files is in the CAM, it can be published to the Clean Access Servers, then distributed to clients/users.
Agent Setup
The Agent Setup is the complete Agent Setup installation file that comes with the Clean Access Manager software release. It is not distributed by Internet updates. It can only be:
1.
2.
3.
For details, see Manually Uploading the Agent to the CAM.Agent Upgrade
The Agent Upgrade (or Patch) can only be:
1.
2.
3.
Auto-Upgrade Compatibility
The newest version of the Clean Access Agent Setup Installation file and Upgrade (Patch) installation file is automatically included with the CAM software for each Cisco Clean Access software release.
Every major and minor version of the Clean Access Agent is intended to have basic compatibility with the same major and minor version of the server product. For example:
•
•
•
Basic compatibility means the Agent is able to perform basic functions such as login, logout, look for configured requirements, and report vulnerabilities.
In addition, new versions of the Clean Access Agent may add additional functionality (e.g. L3 discovery) or additional AV Rule support in conjunction with updates to the Supported Antivirus Product List (e.g. support for new AV product ClamWin).
Note
•
Higher Versions
Release 3.5.1 and above of the CAM/CAS/Agent support Agent Auto-Upgrade, which allows the CAM to pull down the Agent Upgrade version via Updates from the Internet. In this case, any 3.5(1)+ CAS/CAM can pull down any latest 3.5.x Upgrade release of the Agent if it is also 3.5.1+.
By design, the system will typically support Agent versions that are higher than the CAM/CAS version as the result of Agent auto-upgrade, minus any added features that are non-AV related. For example, if the CAM/CAS are running 3.5(1), and a user auto-upgrades to the 3.5.3 Agent, the user would have support for the latest AV products (e.g. Symantec 10.x) but the L3/VPN feature would not be supported as this requires a 3.5(3) CAM/CAS.
Note
Note that the 3.5.3 Agent user on the 3.5(1) CAM/CAS in this case will have the same AV support as if on a 3.5(3) CAM/CAS, because the AV support is tied to the version of the Supported AV Product List and Agent, rather than the CAM/CAS version.
Note
Lower Versions
Where possible, some software releases may provide basic compatibility with older Agent versions, for example, release 3.5(3) supports the 3.4.1 Agent. In this case, the older Agent can perform the basic functions for the CAS/CAM on the new software release, but cannot support the new features such as AV Rules. Refer to the Software Compatibility Matrixes for details on which Agent versions support which specific platform features.
Upgrading Agent to 3.5.1
To upgrade to 3.5.1 or above from 3.5.0 Agent and Below, users must manually install the Agent. However, the 3.5.1 installer does not need to be executed twice (once to remove, second time to install). The 3.5.1 installer auto-detects if a previous Agent version is installed, removes the old version and installs the new version in one pass. It also shuts down the previous version of the application if it is running on the client during upgrade.
You can have users upgrade from previous versions of the Clean Access Agent to version 3.5.1 in several ways, including:
•
Distribute the setup executable (.exe) to users via CD.•
Inform all users to perform web login, which will redirect users to the Clean Access Agent download page if Agent use is required for that user role and client OS.•
This last method is described in Agent Upgrade Through File Distribution Requirement.Agent Upgrade Through File Distribution Requirement
The following steps show how to create a software package requirement to enforce download and installation of the Clean Access Agent (3.5.1+) for users in a specified user role. Users in the role will be required to download and install the required package (in this case, the Agent setup file) before they can log onto the network.
Note
Step 1
Note
Step 2
> tar xzvf CCAAgentSetup-3.5.x.tar.gzStep 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
3.5.0 Agent and Below
Users with new installs of the 3.5.0 Agent (from web download) will see the "Welcome to the Clean Access Agent Setup Wizard" dialog the first time they Run the Setup.exe file.
Users who upgrade to the 3.5.0 Clean Access Agent (from prior versions of the Agent or SmartEnforcer) must select the Remove option and not the Repair option when prompted by the installer. The user should then follow the installer dialogs to remove the old version. Once the old version is removed, the user needs to go back to the download location of the installer Setup.exe file and double-click this executable again to install the newer version of the Agent. At this point the upgrade user sees the "Welcome to the Clean Access Agent Setup Wizard" dialog.
The setup wizard installs the Clean Access Agent to C:\Program Files\Cisco\Clean Access\ on the client.
Note
Manually Uploading the Agent to the CAM
When performing a software upgrade to the CAM and CAS, it is not necessary to upload the installation file for the Clean Access Agent since it is automatically included with the CAM software. However in certain cases, it is possible to manually upload the Clean Access Agent Setup installation file to the CAM directly, for example, if you are not performing a CAM/CAS software upgrade but need to upgrade the version of the Agent to be distributed to clients. (See Software Compatibility for details.)
The CAM will automatically publish the Agent Setup file to the connected CAS(es) when the Agent Setup file is uploaded manually. There is no version check while publishing, so the Agent Setup can be downgraded or replaced.
The following steps describe how to manually upload the Agent setup file to the CAM.
Caution
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Clean Access Supported Antivirus Product List
This section describes the Supported Antivirus Product List that is downloaded to the Clean Access Manager via Device Management > Clean Access > Clean Access Agent > Updates to support AV integration in release 3.5. The Supported Antivirus Product List is a versioned XML file distributed from a centralized update server that provides the most current matrix of supported AV vendors and product versions used to configure AV Rules and AV Definition Update requirements.
The Supported AV list contains information on which AV products and versions are supported in each Clean Access Agent release and CAM/CAS release along with other relevant information. It is updated regularly to bring the relevant information up to date and to include newly added products for new releases. Cisco recommends that you keep your list current, especially when you upload a new Agent Setup version or Agent Patch version to your CAM. Having the latest Supported AV list ensures your AV rule configuration pages list all the new products supported in the new Agent.
Note
Note
The following charts summarize the AV product/version support per client OS as of the latest Cisco Clean Access release:
•
•
For details on what is added per version of the Supported AV Product List, see:
•
The charts show which AV product versions support virus definition checks and automatic update of client virus definition files via the user clicking the Update button on the Clean Access Agent.
You can access additional AV product support information from the CAM web console under Device Management > Clean Access > Clean Access Agent > Rules > Agent-AV Support Info.
Note
Note that Cisco Clean Access works in tandem with the installation schemes and mechanisms provided by supported Antivirus vendors. In the case of unforeseen changes to underlying mechanisms for AV products by Antivirus vendors, the Cisco Clean Access team will upgrade the Supported AV Product List and/or Clean Access Agent in the timeliest manner possible in order to support the new AV product changes. In the meantime, administrators can always use the "custom" rule workaround for the AV product (such as pc_checks/pr_ rules) and configure the requirement for "Any selected rule succeeds."
Supported AV Products (Windows XP / 2000)
Table 7 lists Windows XP/2000 Supported AV Products as of the latest release of the Cisco Clean Access software. (See Table 8 for Windows ME/98).
Table 7 Cisco Clean Access Antivirus Product Support Chart (Windows XP/2K)
Version 49, Release 3.5(11) and 3.5.13 Agent (Sheet 1 of 5)
(Minimum Agent Version Needed)1Command Anti-Virus Enterprise
4.x
yes (3.5.0)
yes (3.5.0)
yes
Command AntiVirus for Windows
4.x
yes (3.5.0)
yes (3.5.0)
yes
Command AntiVirus for Windows Enterprise
4.x
yes (3.5.2)
yes (3.5.2)
yes
ClamWin Antivirus
0.x
yes (3.5.2)
yes (3.5.2)
yes
ClamWin Free Antivirus
0.x
yes (3.5.4)
yes (3.5.4)
yes
CA eTrust Antivirus
7.x
yes (3.5.0)
yes (3.5.0)
yes
eTrust EZ Antivirus
6.1.x
yes (3.5.3)
yes (3.5.8)
yes
eTrust EZ Antivirus
6.2.x
yes (3.5.0)
yes (3.5.0)
yes
eTrust EZ Antivirus
6.4.x
yes (3.5.0)
yes (3.5.0)
yes
eTrust EZ Antivirus
7.x
yes (3.5.0)
yes (3.5.0)
yes
eTrust EZ Armor
6.1.x
yes (3.5.0)
yes (3.5.8)
yes
eTrust EZ Armor
7.x
yes (3.5.0)
yes (3.5.0)
yes
NOD32 antivirus system
2.x
yes (3.5.5)
yes (3.5.5)
yes
F-Prot for Windows
3.14e
yes (3.5.0)
yes (3.5.0)
yes
F-Prot for Windows
3.15
yes (3.5.0)
yes (3.5.0)
yes
F-Secure Anti-Virus
5.x
yes (3.5.0)
yes (3.5.0)
yes
F-Secure Internet Security 2006 Beta
6.x
yes (3.5.8)
yes (3.5.8)
yes
Antivirussystem AVG 6.0
6.x
yes (3.5.0)
yes (3.5.0)
-
AVG 6.0 Anti-Virus - FREE Edition
6.x
yes (3.5.0)
yes (3.5.0)
-
AVG 6.0 Anti-Virus System
6.x
yes (3.5.0)
yes (3.5.0)
-
AVG Antivirensystem 7.0
7.x
yes (3.5.0)
yes (3.5.0)
yes
AVG Anti-Virus 7.0
7.x
yes (3.5.0)
yes (3.5.0)
yes
AVG Free Edition
7.x
yes (3.5.0)
yes (3.5.0)
yes
AntiVir/XP
6.x
yes (3.5.0)
yes (3.5.0)
-
Kaspersky Anti-Virus 2006 Beta
6.0.x
yes (3.5.8)
yes (3.5.8)
-
Kaspersky Anti-Virus Personal
4.5.x
yes (3.5.0)
yes (3.5.0)
yes
Kaspersky Anti-Virus Personal
5.0.x
yes (3.5.0)
yes (3.5.0)
yes
Kaspersky(TM) Anti-Virus Personal 4.5
4.5.x
yes (3.5.0)
yes (3.5.0)
yes
Kaspersky(TM) Anti-Virus Personal Pro 4.5
4.5.x
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan Professional
8.x
yes (3.5.1)
yes (3.5.1)
yes
McAfee VirusScan Professional
8xxx
yes (3.5.0)
yes (3.5.0)
yes
McAfee Internet Security 6.0
8.x
yes (3.5.4)
yes (3.5.4)
yes
McAfee Managed VirusScan
3.x
yes (3.5.8)
yes (3.5.8)
yes
McAfee VirusScan
10.x
yes (3.5.4)
yes (3.5.4)
yes
McAfee VirusScan
4.5.x
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan
8.x
yes (3.5.1)
yes (3.5.1)
yes
McAfee VirusScan
8xxx
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan
9.x
yes (3.5.1)
yes (3.5.1)
yes
McAfee VirusScan
9xxx
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan Enterprise
7.0.x
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan Enterprise
7.1.x
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan Enterprise
7.5.x
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan Enterprise
8.0.x
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan Professional
9.x
yes (3.5.1)
yes (3.5.1)
yes
McAfee VirusScan Professional Edition
7.x
yes (3.5.0)
yes (3.5.0)
yes
Panda Antivirus 6.0 Platinum
6
yes (3.5.0)
yes (3.5.0)
yes
Panda Antivirus Lite
1.x
yes (3.5.0)
yes (3.5.0)
-
Panda Antivirus Lite
3.x
yes (3.5.9)
yes (3.5.9)
-
Panda Antivirus Platinum
7.04.x
yes (3.5.0)
yes (3.5.0)
yes
Panda Antivirus Platinum
7.05.x
yes (3.5.0)
yes (3.5.0)
yes
Panda Antivirus Platinum
7.06.x
yes (3.5.0)
yes (3.5.0)
yes
Panda Platinum 2005 Internet Security
9.x
yes (3.5.3)
yes (3.5.3)
yes
Panda Platinum Internet Security
8.03.x
yes (3.5.0)
yes (3.5.0)
yes
Panda Titanium Antivirus 2004
3.00.00
yes (3.5.0)
yes (3.5.0)
yes
Panda Titanium Antivirus 2004
3.01.x
yes (3.5.0)
yes (3.5.0)
yes
Panda Titanium Antivirus 2005
4.x
yes (3.5.1)
yes (3.5.1)
yes
Panda TruPrevent Personal 2005
2.x
yes (3.5.3)
yes (3.5.3)
yes
Dr.Web
4.32.x
yes (3.5.0)
yes (3.5.0)
yes
BitDefender 8 Free Edition
8.x
yes (3.5.8)
yes (3.5.8)
-
BitDefender 8 Professional Plus
8.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender 8 Standard
8.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender 9 Professional Plus
9.x
yes (3.5.8)
yes (3.5.8)
-
BitDefender 9 Standard
9.x
yes (3.5.8)
yes (3.5.8)
-
BitDefender Free Edition
7.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender Professional Edition
7.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender Standard Edition
7.x
yes (3.5.0)
yes (3.5.0)
-
Sophos Anti-Virus
3.x
yes (3.5.3)
yes (3.5.3)
-
Sophos Anti-Virus
5.x
yes (3.5.3)
yes (3.5.3)
yes
Sophos Anti-Virus version 3.80
3.8
yes (3.5.0)
yes (3.5.0)
-
Norton AntiVirus 2003
9.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2002
8.00.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2002
8.x
yes (3.5.1)
yes (3.5.1)
yes
Norton AntiVirus 2002 Professional
8.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2002 Professional Edition
8.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2003 Professional
9.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2003 Professional Edition
9.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2004
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2004 Professional
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2004 Professional Edition
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2004 (Symantec Corporation)
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2005
11.0.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2006
12.0.x
yes (3.5.5)
yes (3.5.5)
yes
Norton AntiVirus 2006
12.x
yes (3.5.5)
yes (3.5.5)
yes
Norton AntiVirus Corporate Edition
7.x
yes (3.5.1)
yes (3.5.1)
yes
Norton Internet Security
7.x
yes (3.5.0)
yes (3.5.0)
yes
Norton Internet Security
8.0.x
yes (3.5.0)
yes (3.5.0)
yes
Norton Internet Security
8.2.x
yes (3.5.1)
yes (3.5.1)
yes
Norton Internet Security
8.x
yes (3.5.1)
yes (3.5.1)
yes
Norton SystemWorks 2003
6.x
yes (3.5.3)
yes (3.5.3)
yes
Norton SystemWorks 2004 Professional
7.x
yes (3.5.4)
yes (3.5.4)
yes
Norton SystemWorks 2005
8.x
yes (3.5.3)
yes (3.5.3)
yes
Norton SystemWorks 2005 Premier
8.x
yes (3.5.3)
yes (3.5.3)
yes
Symantec AntiVirus
10.x
yes (3.5.3)
yes (3.5.3)
yes
Symantec AntiVirus
9.x
yes (3.5.0)
yes (3.5.0)
yes
Symantec AntiVirus Client
8.x
yes (3.5.0)
yes (3.5.0)
yes
Symantec Client Security
10.x
yes (3.5.3)
yes (3.5.3)
yes
Symantec Client Security
9.x
yes (3.5.0)
yes (3.5.0)
yes
PC-cillin 2002
9.x
yes (3.5.1)
yes (3.5.1)
-
PC-cillin 2003
10.x
yes (3.5.0)
yes (3.5.0)
-
Trend Micro Antivirus
11.x
yes (3.5.0)
yes (3.5.0)
yes
Trend Micro Internet Security
11.x
yes (3.5.0)
yes (3.5.0)
yes
Trend Micro Internet Security
12.x
yes (3.5.0)
yes (3.5.0)
-
Trend Micro OfficeScan Client
5.x
yes (3.5.1)
yes (3.5.1)
yes
Trend Micro OfficeScan Client
6.x
yes (3.5.1)
yes (3.5.1)
yes
Trend Micro OfficeScan Client
7.x
yes (3.5.3)
yes (3.5.3)
yes
Trend Micro PC-cillin 2004
11.x
yes (3.5.0)
yes (3.5.0)
yes
Trend Micro PC-cillin Internet Security 2005
12.x
yes (3.5.3)
yes (3.5.3)
-
Trend Micro PC-cillin Internet Security 2006
14.x
yes (3.5.8)
yes (3.5.8)
-
ZoneAlarm Anti-virus
6.x
yes (3.5.5)
yes (3.5.5)
-
ZoneAlarm Security Suite
5.x
yes (3.5.0)
yes (3.5.0)
-
ZoneAlarm Security Suite
6.x
yes (3.5.5)
yes (3.5.5)
-
ZoneAlarm with Antivirus
5.x
yes (3.5.0)
yes (3.5.0)
-
1 "Yes" in the AV Checks Supported columns indicates the Agent supports the AV Rule check for the product starting from the version of the Agent listed in parentheses (CAM automatically determines whether to use Def Version or Def Date for the check).
2 The Live Update column indicates whether the Agent supports live update for the product via the Agent Update button (configured by AV Definition Update requirement type). For products that support "Live Update," the Agent launches the update mechanism of the AV product when the Update button is clicked. For products that do not support this feature, the Agent displays a message popup. In this case, administrators can configure a different requirement type (such as "Local Check") to present alternate update instructions to the user.
Supported AV Products (Windows ME / 98)
Table 8 lists Windows ME/98 Supported AV Products as of the latest release of the Cisco Clean Access software. (See Table 7 for Windows XP/2000.)
Table 8 Cisco Clean Access Antivirus Product Support Chart (Windows ME/98)
Version 49, Release 3.5(11) and 3.5.13 Agent (Sheet 1 of 2)
(Minimum Agent Version Needed)1CA eTrust Antivirus
7.x
yes (3.5.3)
yes (3.5.3)
yes
eTrust EZ Antivirus
6.1.x
yes (3.5.0)
yes (3.5.8)
yes
eTrust EZ Antivirus
6.2.x
yes (3.5.0)
yes (3.5.0)
yes
eTrust EZ Antivirus
6.4.x
yes (3.5.0)
yes (3.5.0)
yes
eTrust EZ Antivirus
7.x
yes (3.5.3)
yes (3.5.3)
yes
eTrust EZ Armor
6.1.x
yes (3.5.3)
yes (3.5.8)
yes
McAfee Managed VirusScan
3.x
yes (3.5.8)
yes (3.5.8)
yes
McAfee VirusScan
10.x
yes (3.5.4)
yes (3.5.4)
yes
McAfee VirusScan
4.5.x
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan
8.x
yes (3.5.3)
yes (3.5.3)
yes
McAfee VirusScan
9.x
yes (3.5.3)
yes (3.5.3)
yes
McAfee VirusScan Professional
8.x
yes (3.5.3)
yes (3.5.3)
yes
McAfee VirusScan Professional
8xxx
yes (3.5.0)
yes (3.5.0)
yes
McAfee VirusScan Professional
9.x
yes (3.5.3)
yes (3.5.3)
yes
McAfee VirusScan Professional Edition
7.x
yes (3.5.0)
yes (3.5.0)
yes
BitDefender 8 Free Edition
8.x
yes (3.5.8)
yes (3.5.8)
-
BitDefender 8 Professional Plus
8.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender 8 Standard
8.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender 9 Professional Plus
9.x
yes (3.5.8)
yes (3.5.8)
-
BitDefender 9 Standard
9.x
yes (3.5.8)
yes (3.5.8)
-
BitDefender Free Edition
7.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender Professional Edition
7.x
yes (3.5.0)
yes (3.5.0)
-
BitDefender Standard Edition
7.x
yes (3.5.0)
yes (3.5.0)
-
Norton AntiVirus
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2002
8.00.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2002
8.x
yes (3.5.1)
yes (3.5.1)
yes
Norton AntiVirus 2003
9.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2003 Professional Edition
9.x
yes (3.5.3)
yes (3.5.3)
yes
Norton AntiVirus 2004
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2004 (Symantec Corporation)
10.x
yes (3.5.0)
yes (3.5.0)
yes
Norton AntiVirus 2005
11.0.x
yes (3.5.0)
yes (3.5.0)
yes
Norton Internet Security
8.0.x
yes (3.5.0)
yes (3.5.0)
yes
Norton Internet Security
8.x
yes (3.5.1)
yes (3.5.1)
yes
Symantec AntiVirus
9.x
yes (3.5.8)
yes (3.5.3)
yes
Symantec AntiVirus Client
8.x
yes (3.5.9)
yes (3.5.9)
yes
PC-cillin 2003
10.x
yes (3.5.0)
yes (3.5.0)
-
Trend Micro Internet Security
11.x
yes (3.5.0)
yes (3.5.0)
-
Trend Micro Internet Security
12.x
yes (3.5.0)
yes (3.5.0)
-
Trend Micro PC-cillin 2004
11.x
yes (3.5.0)
yes (3.5.0)
-
Trend Micro PC-cillin Internet Security 2005
12.x
yes (3.5.3)
yes (3.5.3)
-
1 "Yes" in the AV Checks Supported columns indicates the Agent supports the AV Rule check for the product starting from the version of the Agent listed in parentheses (CAM automatically determines whether to use Def Version or Def Date for the check).
2 The Live Update column indicates whether the Agent supports live update for the product via the Agent Update button (configured by AV Definition Update requirement type). For products that support "Live Update," the Agent launches the update mechanism of the AV product when the Update button is clicked. For products that do not support this feature, the Agent displays a message popup. In this case, administrators can configure a different requirement type (such as "Local Check") to present alternate update instructions to the user.
Supported AV Product List Versions
Table 9 details enhancements made per version of the Supported Antivirus Product List. See Clean Access Supported Antivirus Product List for the latest Supported AV list as of the latest release. See New and Changed Information to return to the features list per release.
Table 9 Supported AV Product List Versions
Release 3.5(11) —3.5.13 Agent
Version 49, 48, 47, 46, 45, 44, 43, 42, 41, 40
Minor internally used data changes.
Release 3.5(10)—3.5.13 Agent
Version 39
AV Chart (Windows XP/2000/ME/98):
Removed virus def version support for CA eTrust Antivirus 7.x (def date used instead).
Version 38
Minor internally used data change,
Version 37
AV Chart (Windows XP/2000):
Added Live Update support for Trend Micro OfficeScan Client 5.x, 6.x and 7.x
Release 3.5(10) —3.5.12 Agent
Version 36, 35, 34
Minor internally used data changes.
Version 33
Live update support removed for Trend Micro OfficeScan Client 5.x and 6.x
Version 32
Minor internally used data change.
Version 31
AV Chart (Windows XP/2000):
Adds support to the 3.5.12 Agent for the following new products:
•
•
•
•
•
•
•
•
•
•
•
AV Chart (Windows ME/98) — No changes
Version 30
AV Chart (Windows XP/2000)—Adds support for Norton AntiVirus 2006, 12.x
Version 29
Minor internally used data change.
Version 28
No changes to AV support charts for 3.5.x Agents.
Version 27
Minor internally used data change.
Release 3.5(9) —3.5.11 Agent
Version 26
AV Chart (Windows XP/2000)—Adds support for the following new products:
•
•
•
•
•
AV Chart (Windows ME/98) — No changes
Version 25, 24, 23, 23, 21
No changes to AV support charts for 3.5.x Agents.
Release 3.5(8) —3.5.10 Agent,
Release 3.5(7) —3.5.9 AgentVersion 20
Windows XP/2000—Adds support for Panda Antivirus Lite, 3.x
Windows ME/98—Adds support for Symantec AntiVirus Client, 8.x
Windows XP/2000—Removes support for:
•
•
Version 19
Windows XP/2000—Adds def version support for:
•
•
•
Release 3.5(6) —3.5.8 Agent
Version 18
Windows XP/2000—Adds support for:
•
•
•
•
•
•
•
Windows ME/98—Adds support for :
•
•
•
•
•
Release 3.5(5)
Version 17
Windows XP/2000—Adds support for:
•
•
•
•
•
Windows XP/2000—Removes support for:
•
•
•
Version 16
Windows XP/2000—Adds support for Trend Micro OfficeScan Client, 6.x
Version 15
Windows XP/2000—Removes support for Norton AntiVirus Corporate Edition 7.0 for WindowsNT, 7.x (The Clean Access Agent does not support Windows NT.)
Note
Version 14
Windows XP/2000/ME/98—Adds support for:
•
•
Version 13
Windows XP/2000—Adds support for Norton Internet Security, 8.2.x
Release 3.5(4)
Version 12
Windows XP/2000—Adds support for:
•
•
•
•
Windows ME/98—Adds support for McAfee VirusScan, 10.x
Version 11
Windows XP/2000/ME/98—Set Live Update to "no" for BitDefender Free Edition 7.x
Version 10
Windows XP/2000— Sophos Anti-Virus 5.x
AV list updated to use virus definition date instead of version for AV definition check.
Note
Release 3.5(3)
Version 9
Resolves McAfee Engine 9.x version fix (CSCei46351) and BitDefender definition date issue (CSCei46336). See Resolved Caveats - Release 3.5(3) for details.
Windows XP/2000—Adds support for 12 new products:
•
•
•
•
•
•
•
•
•
•
•
•
Windows 9x/ME—Adds support for 9 new products:
•
•
•
•
•
•
•
•
•
•
Release 3.5.2.1
Version 8
Windows XP/2000/ME/98— Computer Associates products.
AV list updated to use virus definition date instead of version for AV definition check.
Release 3.5(2)
Version 7
Windows XP/2000—Adds support for new product ClamWin.
Windows ME/98— Symantec ME/98 products.
AV list updated to use virus definition date instead of version for AV definition checks.
Release 3.5(1)
Version 6
Windows XP/2000—Adds support for 7 new product versions to existing vendors McAfee, Panda, Symantec, and Trend Micro.
Caveats
This section describes the following caveats:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Note
http://www.cisco.com/cgi-bin/Support/Bugtool/home.pl
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
Open Caveats - Release 3.5.11.1
Resolved Caveats - Release 3.5.11.1
Resolved Caveats - Release 3.5(11)
Resolved Caveats - Release 3.5(10)
Resolved Caveats - Release 3.5(9)
Table 14 List of Resolved Caveats
CSCsc64719
Yes
CA AV configured to use a local http server, Agent cause CA to check FTP
The customer has the CA AV configured to only check a local HTTP server. When the agent attempts to update, the agent is causing the CA software to check a FTP server on the Internet instead of the customer custom configure local http server.
Symptom: CA Antivirus fails to update from locally configured http server. When the CCA Agent is starting the update connection.
Conditions: CA Antivirus is configured to download its update from a local http server instead of the ftp server on the Internet. CCA agent detects that the AV software isn't up to date. User select for the CCA agent to update the AV client.
Workaround: Use default setting for the CA AV or manually start the update from CA AV.
CSCsc72195
Yes
DHCP options cannot be added to Managed CAS through Clean Access Manager
This issue was found in 3.5.8 in Real-IP Gateway mode. When setting up the DCHP options on a Managed CAS, the options show up in the GUI, but are not reflected in the dhcpd.conf file on the CAS.
Example: 'option netbios-node-type 2;' shows up in the CAM's GUI, but not in the dhcpd.conf file of the CAS.
CSCsc85316
Yes
Firefox has problems with the scan reports link
The "user info" box is checked for the successfully authenticated users. When a Firefox client clicks on the Scan Report link on the page that opens with the Logout button, a Javascript error message appears.
CSCsc85405
Yes
Obsolete JSPs can cause DoS attack
Note
CSCsc88240
Yes
Users can login using CCA Agent and is allowed on the network without accepting the "Network Usage Terms & Conditions".
Steps to reproduce:
1. Configure the CAM to check the software and run nessus scans on clients.
2. Launch CCA Agent and perform the login.
3. When the "Accept/Reject" Dialog box for network usage policy shows up, right click on CCA Agent icon in tray and click "Exit"
4. Launch CCA Agent again and perform the login. The user is not shown the "Network Usage Terms & Conditions" and does bypass the "Accept/Reject" these terms.
Technically, the user never accepted the "Network Usage Terms & Conditions" and was allowed to access the network.
CSCsc91332
Yes
Spaces not stripped from username/password while creating new local user
Spaces [left and right] are not stripped from username / password while creating or modifying local users. However, the [left & right] spaces are stripped from the username/password entered into the CCA agent or in the web form.
CSCsc97952
Yes
H+BEDV AntiVir/XP 6.32.x def date/version couldn't be detected
CSCsd12491
Yes
CAM sets trunk ports on switch to administratively down ("shut") state
CSCsd17858
Yes
Agent login pops up after user assigned to quarantine role
Assigned quarantine role when agent failed network scan, CAM side online user show user login as quarantine role, but Agent side login window pops up.
CSCsd19177
Yes
SNMP trapsink settings are lost after performing upgrade
CSCsd20418
Yes
HA problem with both servers being active when switch is rebooted
HA state of power cycled standby unit comes up as active if the switch it is connected to is down during its reboot. When the switch comes up, both CAS units are then active, and stay active.
Resolved Caveats - Release 3.5(8)
Resolved Caveats - Release 3.5(7)
Resolved Caveats - Release 3.5.6.1
Resolved Caveats - Release 3.5(6)
Resolved Caveats - Release 3.5.5.1
Resolved Caveats - Release 3.5(5)
Table 20 Resolved Caveats
CSCei86991
Yes
Enhancement option to configure both SNMP V1 & SNMP V3 on the CAM. The SNMP Trap Receiver can now accept all versions of notifications (v1/v2c/v3)
CSCej00935
Yes
Agent should stop issuing HTTP thread from sending any more requests after client machine has logged in
CSCej01013
Yes
Under some situations, the postgres process does not start correctly because a database lock file is kept around. This is fixed in release 3.5(5).
CSCej01021
Yes
Change the CAS to provide an option to disable the L3 discovery for the agent
CSCsb56270
Yes
Clean Access Agent only respects and displays the auth providers in the login page set for ALL or WINDOWS_ALL operating systems.
Note
This issue does not affect web login users.When you configure auth providers in user pages for specific Windows OSes rather than ALL or WINDOWS_ALL (e.g. WINDOWS_XP) Clean Access Agent users will not be able to use the auth providers from that page.
Workaround (if not upgrading to 3.5.5):A default login page must be present to allow all users (web login or Clean Access Agent) to log in. Put all auth providers you want to make available for Agent users in a WINDOWS_ALL login page. To edit the user login page:
1.
2.
3.
4.
5.
6.
7.
8.
9.
CSCsb65542
Yes
Nessus plugins fail to install
Symptom: Trying to install the NESSUS plugins, the browser eventually times out and the plugins are never installed.
Workaround:
1.
2.
3.
4.
All steps are required and must be in the above order.
CSCsb72670
Yes
Change L3 HTTP-based discovery to SWISS-based discovery for CAM/CAS
CSCsb72687
Yes
Instead of using the Windows_ALL tag, the Agent should provide complete and accurate O/S information to the CAS.
Note
CSCsb74632
Yes
The Switch Management events for notifications received by the CAM from switches are no longer written to event log. Most of the logging is now moved from event log (database) to only /perfigo/logs/perfigo-log0.log.0 by default.
CSCsb74642
Yes
Now, OOB respects entries in the Filters -> Devices list. If devices are entered there, then no clean access policies are applied to it.
CSCsb74650
Yes
RADIUS Accounting Failover now interprets the timeout value in seconds as it should instead of the earlier interpretation (ms).
CSCsb79391
Yes
Cannot update DAT files after upgrading Agent to 3.5.6
Note
Symptom: After upgrading the Agent to 3.5.6, McAfee Enterprise 8.0 updates cannot be installed
Workaround: 1. Downgrade to 3.5.4; 2. Take the PC off the clean access network, disable the Agent and then update Mcafee
Resolved Caveats - Release 3.5.4.1
Resolved Caveats - Release 3.5(4)
Resolved Caveats - Release 3.5.3.2
Resolved Caveats - Release 3.5.3.1
Resolved Caveats - Release 3.5(3)
Resolved Caveats - Release 3.5.2.2
Resolved Caveats - Release 3.5.2.1
Resolved Caveats - Release 3.5(2)
Table 28 Resolved Caveats
CSCei03402
Yes
CAM Apache/Tomcat processes die when monitored by a 3rd party app
Note
If a third party monitoring application connects to the Clean Access Manager on port 80 to determine if the webserver is running, it is possible that repeated connections can cause the Manager to freeze up or stop responding. The only errors are problems with Tomcat and Apache in the system logs.
Symptom: Clean Access Manager keeps shutting down periodically, and the Clean Access Servers cannot be correctly managed.
Conditions: Running an application that connects to port 80 on the Manager to check to see if the webserver is up will cause this to occur. Specifically, something as little as running the "HEAD/1.1" command periodically can cause the system to crash.
Workaround: Turn off any monitoring tool until 3.5(2)CSCei04375
Yes
Re-tag Trusted Side VLAN ID does not work correctly in Real-IP mode
This affects 3.5(0) Clean Access Server in Real-IP mode.
When vlan retag is used for the trusted side in Real-IP mode, the return packet is also retagged onto the untrusted network. In doing so, the end device on the untrusted cannot communicate to the external (trusted) network.
CSCei07657
Yes
Clean Access Agent New AV Rule Antivirus vendor dropdown has "--Please update AV list--"
With new installs or upgrade to 3.5(1), and with the current version of Clean Access agent installed, the New AV Rule dropdown for Antivirus vendor only lists "--Please update AV list --".
CSCei08915
Yes
Replacing all occurrences of $user$ in filters (LDAP auth)
The first occurrence was changed, others had been left unaltered.
CSCei08925
Yes
Input validation on LDAP Attribute Mapping rule.
The name parameter in mapping rule conditions should not be empty.
CSCei10242
Yes
Crashes when closed by clicking X when timer expires
When creating a rule on the server so the client won't pass through it, and logging in from the client, if the requirement is not finished and the client times out from temporary role, and instead of clicking the OK button uses the window x button on the top right corner to close the window, the client crashes.
CSCei10529
Yes
Any Rule fails if vendor is not Norton and using def version
Note
The ANY definition rule will only succeed if:
•
•
Otherwise it will fail. The ANY installation check is not affected.
Resolved Caveats - Release 3.5(1)
Resolved Caveats - Release 3.5(0)
Known Issues for Cisco NAC Appliance
This section describes known issues when integrating Cisco NAC Appliance with third-party elements.
Known Issues with Switches
For complete details, refer to Switch Support for Cisco NAC Appliance.
Installing or Upgrading to a New Software Release
This section provides the following software installation and upgrade information:
•
•
General Procedure
Caution
Do NOT import any snapshot you made prior to 3.5 migration after you have upgraded to release 3.5, or you will impede the functioning of your Clean Access Manager.
Cisco recommends that you:
1.
2.
–
3.
–
4.
5.
New Installation of 3.5(x)
If you purchased and are performing a first installation of Cisco Clean Access, use the following steps.
For New Installation:
1.
2.
a.
b.
3.
4.
5.
6.
Note
For detailed software installation steps, see the following guides:
•
•
Upgrade Procedure for 3.5(x)
Before upgrading to 3.5 from 3.2.6 or above, carefully read the following instructions:
•
•
•
If upgrading failover pairs, you must use the procedure described in:
•
Before You Upgrade
Caution
•
You must upgrade your Clean Access Manager and all your Clean Access Servers concurrently. The Clean Access architecture is currently not designed for heterogeneous support (i.e., some Clean Access Servers running 3.5 software and some running 3.4 software).
•
Depending on the number of Clean Access Servers you have, the upgrade process should be scheduled as downtime. Our estimates suggest that it takes approximately 15 minutes for the Clean Access Manager upgrade and 10 minutes for each Clean Access Server upgrade. Use this approximation to estimate your downtime window.
•
While the Clean Access Manager upgrade is being conducted, the Clean Access Server (which has not yet been upgraded, and which loses connectivity to the Clean Access Manager during Clean Access Manager restart or reboot) continues to pass authenticated user traffic.
Caution
•
For safekeeping, it is recommended to back up your current Clean Access Manager installation (using Administration > Backup) both before and after the upgrade and to save the snapshot on your local computer. Make sure to download the snapshots to your desktop/laptop for safekeeping. Backing up prior to upgrade enables you to revert to your previous 3.4 or 3.3 database should you encounter problems during upgrade. Backing up immediately following upgrade preserves your upgraded tables and provides a baseline of your 3.5 database. After the migration is completed, go to the database backup page (Administration > Backup) in the CAM web console. Download and then delete all earlier snapshots from there as they are no longer compatible. See also Create CAM DB Backup Snapshot.
Warning
•
Once you have upgraded your software to 3.5, if you wish to revert to 3.4 or 3.3, note that you will need to reinstall 3.4 or 3.3 from the CD and recover your configuration based on the backup you performed prior to upgrading to 3.5.
•
For upgrade via SSH, you will need your CAM and CAS root user password (default password is cisco123). For web console upgrade (release 3.5(3) and above), you will need your CAM web console admin user password (and, if applicable, CAS direct access console admin user password).
Create CAM DB Backup Snapshot
Perform a full backup of your CAM database by creating a backup snapshot both before and after the upgrade. Make sure to download the snapshots to your desktop/laptop for safekeeping. Backing up prior to upgrade enables you to revert to your previous database should you encounter problems during upgrade. Backing up immediately following upgrade preserves your upgraded tables and provides a baseline of your 3.5 database.
Warning
Step 1
Step 2
Step 3
Note
Step 4
Step 5
Download the Upgrade File
For Cisco Clean Access 3.5 release upgrades, a single file, cca_upgrade_3.5.x.tar.gz, is downloaded to each Clean Access Manager (CAM) and Clean Access Server (CAS) installation machine. The upgrade script automatically determines whether the machine is a CAM or CAS.
For Cisco Clean Access patch upgrades, the upgrade file can be for the CAM only, CAS only, or for both CAM/CAS, depending on the patch upgrade required.
Step 1
Step 2
–
–
–
–
Step 3
Upgrade via Web Console (from 3.5.3 and Above Only)
If running release 3.5(3) or above of the Cisco Clean Access software on standalone machines, administrators have the option of performing software upgrade on the CAS and CAM via web console:
•
•
•
Note
•
•
•
•
Note the following:
•
•
•
With web upgrade, the CAM and CAS automatically perform all the upgrade tasks that are done manually for SSH upgrade (for example, untar file, cd to /store, run upgrade script). The CAM also automatically creates snapshots before and after upgrade (see Database Recovery Tool for details). When upgrading via web console only, the machine automatically reboots after the upgrade completes. The steps for web upgrade are as follows:
1.
2.
3.
Upgrade CAS from CAS Management Pages (3.5.5 and above)
Once release 3.5(5) is installed on the CAS, web upgrades to the CAS (e.g. to 3.5(6) and above) can be performed via the CAS management pages as described below. If you are running release 3.5(3) or 3.5(4) you must follow the instructions in Upgrade CAS from CAS Web Console (3.5.3/3.5.4).
Step 1
Step 2
a.
b.
c.
Step 3
cca_upgrade_3.5.x.tar.gz (CAM/CAS release upgrade file), or
cca-3.5.x-to-3.5.x.y-upgrade.tar.gz (CAM/CAS patch upgrade file), or
cas-3.5.x-to-3.5.x.y-upgrade.tar.gz (CAS-only patch upgrade file)
Step 4
Step 5
Note
Step 6
Step 7
Step 8
Note
Upgrade CAS from CAS Web Console (3.5.3/3.5.4)
If running release 3.5(3) or 3.5(4), you must use the CAS direct web console to upgrade the CAS via web. If running release 3.5(5) or above, you can follow the instructions to Upgrade CAS from CAS Management Pages (3.5.5 and above), or optionally use the instructions below.
Step 1
Step 2
a.
a.
Step 3
Step 4
cca_upgrade_3.5.x.tar.gz (CAM/CAS release upgrade file), or
cca-3.5.x-to-3.5.x.y-upgrade.tar.gz (CAM/CAS patch upgrade file), or
cas-3.5.x-to-3.5.x.y-upgrade.tar.gz (CAS-only patch upgrade file), or
Step 5
Step 6
Note
•
Step 7
Step 8
Step 9
Note
Upgrade CAM from CAM Web Console
After you have upgraded each CAS, upgrade your CAM as described below.
Step 1
Step 2
Step 3
cca_upgrade_3.5.x.tar.gz (CAM/CAS release upgrade file)
cca-3.5.x-to-3.5.x.y-upgrade.tar.gz (CAM/CAS patch upgrade file)
cam-3.5.x-to-3.5.x.y-upgrade.tar.gz (CAM-only patch upgrade file)
Step 4
Step 5
Note
•
Step 6
Step 7
Note
Upgrade via Console/SSH
Use the instructions in this section to upgrade your standalone CAM/CAS using the standard console/SSH upgrade procedure.
Note
Note
Note
For release 3.5 upgrades, a single file, cca_upgrade_3.5.x.tar.gz, is downloaded to each installation machine. The upgrade script automatically determines whether the machine is a Clean Access Manager (CAM) or Clean Access Server (CAS), and executes if the current system is running release 3.2(6) and above.
Download the Upgrade File and Copy to CAM/CAS
Step 1
Step 2
If using WinSCP or SSH File Transfer (replace .x with minor upgrade version number):
a.
b.
If using PSCP (replace .x with minor upgrade version number):
a.
b.
c.
pscp cca_upgrade_3.5.x.tar.gz root@ipaddress_manager:/stored.
pscp cca_upgrade_3.5.x.tar.gz root@ipaddress_server:/storePerform SSH Upgrade on the CAM
Step 3
a.
b.
c.
cd /stored.
tar xzvf cca_upgrade_3.5.x.tar.gz4.
cd cca_upgrade_3.5.xsh ./UPGRADE.sh
Note
5.
Upgrade CCA Agent version to 3.5.x? (y/n)? [y]e.
rebootPerform SSH Upgrade on the CAS
Step 4
a.
b.
c.
cd /stored.
tar xzvf cca_upgrade_3.5.x.tar.gz6.
cd cca_upgrade_3.5.xsh ./UPGRADE.she.
rebootf.
Upgrading High Availability Pairs
If upgrading an existing high-availability (failover) pair of Clean Access Managers or Clean Access Servers to 3.5(x), you must use the instructions in this section.
This section describes the following:
•
•
Accessing Web Consoles for High Availability
CAM High Availability (failover) is configured in the CAM web console under Administration > CCA Manager > Network & Failover | High Availability Mode
•
•
CAS High Availability (failover) is configured in the CAS direct access web console under Administration > Network Settings > Failover | Clean Access Server Mode.
•
•
Determining Active and Standby Clean Access Manager
For a Clean Access Manager High-Availability pair:
•
•
The web console for the standby (inactive) CAM will only display the Administration module menu.
Determining Active and Standby Clean Access Server
For a Clean Access Server High-Availability pair:
•
https://<primary CAS (eth0)IP>/adminFor example, https://172.16.1.2/admin
•
https://<secondary CAS (eth0)IP>/adminFor example, https://172.16.1.3/admin
For failover CAS pairs, Device Management > CCA Servers > List of Servers in the CAM web console displays the Service IP of the CAS pair first, followed by the IP address of the active CAS in brackets. When the secondary CAS takes over, its IP address will be listed in the brackets as the active server.
Instructions for Upgrading High Availability CAM and CAS
The following is the generally recommended way to upgrade an existing high-availability (failover) pair of Clean Access Managers or Clean Access Servers.
Warning
Note
Step 1
Step 2
Step 3
a.
tar xzvf cca_upgrade_3.5.x.tar.gzb.
c.
./fostate.shThe results should be either "My node is active, peer node is standby" or "My node is standby, peer node is active." No nodes should be dead. This should be done on both boxes, and the results should be that one box considers itself active and the other box considers itself in standby mode. Future references in these instructions that specify "active" or "standby" refer to the results of this test as performed at this time.
Note
Step 4
shutdown -h nowStep 5
Step 6
Step 7
./fostate.shMake sure this returns "My node is active, peer node is dead" before continuing.
Step 8
a.
b.
./UPGRADE.sh
Note
Caution
c.
Upgrade CCA Agent version to 3.5.x? (y/n)? [y]Step 9
shutdown -h nowStep 10
Step 11
Step 12
a.
b.
cd cca_upgrade_3.5.xc.
./UPGRADE.sh
Caution
d.
Upgrade CCA Agent version to 3.5.x? (y/n)? [y]Step 13
shutdown -h nowStep 14
Step 15
Note
Troubleshooting
This section discusses the following:
•
•
•
•
•
•
•
•
No Web Login Redirect / CAS Cannot Establish Secure Connection to CAM
•
Clean Access Server is not properly configured, please report to your administrator
A login page must be added and present in the system in order for both web login and Clean Access Agent users to authenticate. If a default login page is not present, Clean Access Agent users will see the following error dialog when attempting login:
Clean Access Server is not properly configured, please report to your administratorTo resolve this issue, add a default login page on the CAM under Administration > User Pages > Login Page > Add.
Clean Access Server could not establish a secure connection to the Clean Access Manager at <IP/domain>
The following client connection errors can occur if the CAS does not trust the certificate of the CAM, or vice-versa:
•
•
Clean Access Server could not establish a secure connection to the Clean Access Manager at <IPaddress or domain>These errors typically indicate one of the following certificate-related issues:
•
•
•
•
To identify common issues:
1.
(under Administration > CCA Manager > SSL Certificate > Export Certificate Request)2.
(under Administration > CCA Manager > System Time, and
Device Management > CCA Servers > Manage [CAS_IP] > Misc > TimeTo resolve these issues:
1.
2.
3.
4.
5.
CAM/CAS Support Logs
Starting with release 3.5(3), there are two new Support Logs web console pages for the CAM and CAS to facilitate TAC support when a customer has issues. The Support Logs page allows administrators to combine a variety of system logs (such as information on open files, open handles, and packages) into one tarball that can be sent to TAC to be included in the support case. Administrators should download the following support logs from the CAM web console when sending their customer support request:
•
•
For releases prior to 3.5(3), contact TAC for assistance on manually creating the support logs.
Agent AV Rule Troubleshooting
To view administrator reports for the Clean Access Agent go to Device Management > Clean Access > Clean Access Agent > Reports.
When troubleshooting AV Rules, please provide the following information:
1.
2.
3.
4.
5.
6.
IE 7.0 Beta and Clean Access Agent
Internet Explorer 7.0 Beta is not supported when using the Clean Access Agent. The Agent will not be able to login and perform other operations if the user has IE 7.0 installed.
Problem
Solution
See also Web Browser Compatibility.
Enable Debug Logging on the Clean Access Agent
Note
•
•
You can enable debug logging on the Clean Access Agent by adding a registry value on the client in HKCU\Software\Cisco\Clean Access Agent\LogLevel with value "debug."
The event log will be created in the directory <user home directory>\ Application Data\CiscoCAA\. You can copy this event log to include it in a customer support case.
To generate the Clean Access Agent debug log:
1.
2.
3.
Note
4.
5.
6.
7.
8.
9.
10.
a.
b.
c.
Note
•
11.
Recovering Root Password for CAM/CAS (Release 3.5.x or Below)
To recover the root password for CAM/CAS on release 3.5(x), you can use the Linux procedure to boot to single user mode and change the root password:
1.
2.
3.
4.
5.
6.
7.
Troubleshooting Switch Support Issues
To troubleshoot switch issues, see Switch Support for Cisco NAC Appliance.
Troubleshooting Network Card Driver Support Issues
For network card driver troubleshooting, see:
Other Troubleshooting Information
For general troubleshooting tips, see the following Technical Support webpage:
http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html
Documentation Updates
Table 31 Updates to Release Notes for Cisco Clean Access (NAC Appliance) Version 3.5(x)
6/28/07
Added caveat CSCsd90433 to Open Caveats - Release 3.5.11.1
3/16/07
Moved caveat CSCsi07595 to Open Caveats - Release 3.5.11.1
3/9/07
Added caveat CSCsi07595 to address the DST 2007 fix
19-Jan-07
Release 3.5.11.1
•
•
•
•
•
•
•
18-Aug-06
•
•
14-Jul-06
Moved CSCse53459 to Open Caveats table for 3.5(11)
7-Jul-06
Updated Resolved Caveats - Release 3.5(11) (for CSCse53459)
27-Jun-06
Supported Switches for Cisco Clean Access - updates for 4000/4500 and 6000/6500
26-Jun-06
Release 3.5(11)
•
•
•
•
•
•
•
7-Mar-06
Release 3.5(10)
30-Jan-06
Release 3.5(9)
29-Nov-05
Release 3.5(8)
27-Oct-05
Release 3.5(7)
12-Oct-05
Release 3.5.6.1
12-Oct-05
Release 3.5.5.1
28-Sep-05
Release 3.5(6)
6-Sep-05
Release 3.5.4.1
6-Sep-05
Release 3.5.3.2
6-Sep-05
Release 3.5.2.2
31-Aug-05
Release 3.5(5)
10-Aug-05
Release 3.5(4)
27-Jul-05
Release 3.5.3.1
20-Jul-05
Release 3.5(3)
15-Jun-05
Release 3.5.2.1
2-Jun-05
Release 3.5(2)
20-May-05
Release 3.5(1)
14-Apr-05
Release 3.5(0)
Related Documentation
For the latest updates to Cisco NAC Appliance (Cisco Clean Access) documentation on Cisco.com see:
http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html
or simply http://www.cisco.com/go/cca
•
•
•
•
•
•
See the latest updates to the 3.5(x) Cisco Clean Access documentation at:
http://www.cisco.com/univercd/cc/td/doc/product/vpn/ciscosec/cca/cca35/index.htm
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. This section explains the product documentation resources that Cisco offers.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/techsupport
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Product Documentation DVD
The Product Documentation DVD is a library of technical product documentation on a portable medium. The DVD enables you to access installation, configuration, and command guides for Cisco hardware and software products. With the DVD, you have access to the HTML documentation and some of the PDF files found on the Cisco website at this URL:
http://www.cisco.com/univercd/home/home.htm
The Product Documentation DVD is created and released regularly. DVDs are available singly or by subscription. Registered Cisco.com users can order a Product Documentation DVD (product number DOC-DOCDVD= or DOC-DOCDVD=SUB) from Cisco Marketplace at the Product Documentation Store at this URL:
http://www.cisco.com/go/marketplace/docstore
Ordering Documentation
You must be a registered Cisco.com user to access Cisco Marketplace. Registered users may order Cisco documentation at the Product Documentation Store at this URL:
http://www.cisco.com/go/marketplace/docstore
If you do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Documentation Feedback
You can provide feedback about Cisco technical documentation on the Cisco Support site area by entering your comments in the feedback form available in every online document.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
From this site, you will find information about how to do the following:
•
•
•
A current list of security advisories, security notices, and security responses for Cisco products is available at this URL:
To see security advisories, security notices, and security responses as they are updated in real time, you can subscribe to the Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed. Information about how to subscribe to the PSIRT RSS feed is found at this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you have identified a vulnerability in a Cisco product, contact PSIRT:
•
An emergency is either a condition in which a system is under active attack or a condition for which a severe and urgent security vulnerability should be reported. All other conditions are considered nonemergencies.
•
In an emergency, you can also reach PSIRT by telephone:
•
•
Tip
Never use a revoked encryption key or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one linked in the Contact Summary section of the Security Vulnerability Policy page at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
The link on this page has the current PGP key ID in use.
If you do not have or use PGP, contact PSIRT to find other means of encrypting the data before sending any sensitive material.
Product Alerts and Field Notices
Modifications to or updates about Cisco products are announced in Cisco Product Alerts and Cisco Field Notices. You can receive these announcements by using the Product Alert Tool on Cisco.com. This tool enables you to create a profile and choose those products for which you want to receive information.
To access the Product Alert Tool, you must be a registered Cisco.com user. Registered users can access the tool at this URL:
http://tools.cisco.com/Support/PAT/do/ViewMyProfiles.do?local=en
To register as a Cisco.com user, go to this URL:
http://tools.cisco.com/RPF/register/register.do
Obtaining Technical Assistance
Cisco Technical Support provides 24-hour-a-day award-winning technical assistance. The Cisco Support website on Cisco.com features extensive online support resources. In addition, if you have a valid Cisco service contract, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not have a valid Cisco service contract, contact your reseller.
Cisco Support Website
The Cisco Support website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day at this URL:
http://www.cisco.com/en/US/support/index.html
Access to all tools on the Cisco Support website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Note
Tip
If you suspect that the browser is not refreshing a web page, force the browser to update the web page by holding down the Ctrl key while pressing F5.
To find technical information, narrow your search to look in technical documentation, not the entire Cisco.com website. After using the Search box on the Cisco.com home page, click the Advanced Search link next to the Search box on the resulting page and then click the Technical Support & Documentation radio button.
To provide feedback about the Cisco.com website or a particular technical document, click Contacts & Feedback at the top of any Cisco.com web page.
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests, or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411
Australia: 1 800 805 227
EMEA: +32 2 704 55 55
USA: 1 800 553 2447For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—An existing network is "down" or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operations are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of the network is impaired while most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/offer/subscribe
•
•
http://www.cisco.com/go/marketplace/
•
•
•
http://www.cisco.com/en/US/products/index.html
•
http://www.cisco.com/discuss/networking
•
http://www.cisco.com/univercd/cc/td/doc/abtunicd/136957.htm
•
http://www.cisco.com/en/US/learning/index.html
This document is to be used in conjunction with the documents listed in Related Documentation.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2008 Cisco Systems, Inc. All rights reserved.
