topic Interoperability between Network Access Manager and other Connection Managers in Network Access Control

Interoperability between Network Access Manager and other Connection Managers

fpanada — Tue, 08 Mar 2016 13:47:40 GMT

Hi Team,

We are doing a POC with ISE 1.3 and customer is using Anyconnect to permit Win7 endpoint to choose one of their certifcates.

Now we release there could be a problem between Anyconnect and HP Connection Manager installed on the endpoints.

Customer found the following on cisco.com:

"Interoperability between Network Access Manager and other Connection Managers

When the Network Access Manager operates, it takes exclusive control over the network adapters and blocks attempts by other software connection managers (including the Windows native connection manager) to establish connections. Therefore, if you want AnyConnect users to use other connection managers on their endpoint computers (such as iPassConnect Mobility Manager), they must disable Network Access Manager either through the Disable Client option in the Network Access Manager GUI, or by stopping the Network Access Manager service."

Because we need AC just to choose the certifcates, if we will disable Network Access Manager, do we still have chance to select certficates ?

Thank you

Best Regards

Re: Interoperability between Network Access Manager and other Connection Managers

Timothy Abbott — Tue, 08 Mar 2016 16:40:24 GMT

Hi Fabio,

Based on the description you found on CCO, I suspect you would not have that capability once it was disabled. The easiest way to find out would be to test in a lab environment.

Regards,

-Tim

Re: Interoperability between Network Access Manager and other Connection Managers

jahamilton1 — Tue, 28 Mar 2017 08:32:26 GMT

Hi Fabio, what was your lab experience?

Thanks.

Re: Interoperability between Network Access Manager and other Connection Managers

Jason Kunst — Tue, 28 Mar 2017 17:19:47 GMT

its not clear to me are you trying to choose cert for VPN or dot1x (NAM wired/wireless) they are separate modules. If its for VPN then it won't collide with other Managers that are handling wired/wireless supplicant. If you're only using VPN then you need to remove NAM