topic Re: NAC attribute definition File in Network Security

NAC attribute definition File

jmoreno — Fri, 21 Feb 2020 08:46:32 GMT

I need to found the Nac Attributes definition file to Antivirus VirusScan of Network associate. I searched on the WEB but I not find. Somebody know from where I can download.

Re: NAC attribute definition File

smahbub — Mon, 20 Mar 2006 21:04:38 GMT

ACS does not include any non-Cisco attributes by default. Therefore, you must import a NAC Attribute Definition File (ADF) from each vendor application that you would like to validate in your NAC posture-validation policies. The attributes that are added can be used to create conditions for internal policies.

NAC introduces the ability to authorize network hosts not only based upon user or machine identity; but also upon a host's posture validation. The posture validation is determined by comparing the host's credentials to a posture-validation policy which you create from attribute-value pairs (AVPs), which are defined by Cisco and other vendors who are NAC partners. Since the range of NAC attributes extends across many vendors and applications, you must import the non-Cisco attributes.

To import a NAC attribute definition file:

Obtain one or more ADFs for the NAC-compatible applications that you want to validate with ACS.

Place the ADFs in the same directory as the ACS utility, CSUtil.exe , or a directory that is accessible by CSUtil.exe.

On the host that is running ACS, open a cmd command prompt and navigate to the directory that contains CSUtil.exe.

Add the AVPs to ACS by using the command:

CSUtil.exe -addAVP filename.adf

After successfully adding the AVPs, restart CSAdmin, CSLog, and CSAuth.

Re: NAC attribute definition File

HarrytheBrain — Wed, 22 Mar 2006 08:05:01 GMT

in some cases ACS includes the first 2 attributes of vendors, for example altiris or qualys auditserver.

They are in config but not active.

To activate them you need a dummy attribute-definition-file, for example:

[attr#0]

vendor-id=ID

vendor-name=NAME

application-id=6

application-name=Audit

attribute-id=00003

attribute-name=Dummy-attr

attribute-profile=out

attribute-type=unsigned integer

but in your case you will need more then this,

so the only way is to contact the distributor

or your cisco contact for that file.

(i got my 2 adf files i used from cisco,

because the distributor didn't have them,

weird but true)

and don't forget the clientside info files

for the posture agent, you will need them too.

(.inf, .dll)

best regards

harry

Re: NAC attribute definition File

abz — Thu, 06 Apr 2006 20:14:13 GMT

You can use the folloing for network associates as the ADF file. Unfortunately when you try to find these files they are hard to find and nobody seems to know what you are talking about. Just copy and paste these and import them using the CSUtil.exe after importing this you will need to restart CSAdmin, CSLog and CSAuth.

Adam

ADF Below:

[attr#29]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00001

attribute-name=Application-Posture-Token

attribute-profile=out

attribute-type=unsigned integer

[attr#30]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00002

attribute-name=System-Posture-Token

attribute-profile=out

attribute-type=unsigned integer

[attr#31]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00003

attribute-name=Software-Name

attribute-profile=in out

attribute-type=string

[attr#32]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00004

attribute-name=Software-ID

attribute-profile=in out

attribute-type=unsigned integer

[attr#33]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00005

attribute-name=Software-Version

attribute-profile=in out

attribute-type=version

[attr#34]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00006

attribute-name=Scan-Engine-Version

attribute-profile=in out

attribute-type=version

[attr#35]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00007

attribute-name=Dat-Version

attribute-profile=in out

attribute-type=version

[attr#36]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00008

attribute-name=Dat-Date

attribute-profile=in out

attribute-type=date

[attr#37]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00009

attribute-name=Protection-Enabled

attribute-profile=in out

attribute-type=unsigned integer

[attr#38]

vendor-id=3401

vendor-name=NAI

application-id=3

application-name=AV

attribute-id=00010

attribute-name=Action

attribute-profile=out

attribute-type=string

Re: NAC attribute definition File

HarrytheBrain — Fri, 07 Apr 2006 08:29:54 GMT

so it's one standard for all !?

as i see, for an av-client it's just necessary

to change the vendor-id and the vendor-name,

everything else is identical.

The one you posted is for example the same

as the adf for trendmicro (just vendor-id=6101 and

vendor-name=Trend)

Re: NAC attribute definition File

abz — Mon, 10 Apr 2006 20:50:01 GMT

Harry,

I guess so. I do know that it works for doing posture validation.

Adam

Re: NAC attribute definition File

slipovse — Thu, 18 May 2006 19:06:43 GMT

ADF files can be downloaded here: http://nac.cisco.com/Public/NACProgram/ADFs/

Silvo

Re: NAC attribute definition File

ita_hsieh — Tue, 20 Jun 2006 14:24:51 GMT

hi Silvo the URL you provided can't be opened?

Re: NAC attribute definition File

axfood — Mon, 26 Jun 2006 10:21:15 GMT

Hello

I have try to save this in a file and run but it don't work. I get this.

C:\Program Files\CiscoSecure ACS v4.0\bin>CSUtil.exe -addAVP c:\test\nac.adf

=== AVP Summary ===

0 AVPs have been added to the dictionary (DB).

C:\Program Files\CiscoSecure ACS v4.0\bin>

Re: NAC attribute definition File

axfood — Tue, 29 Aug 2006 10:29:50 GMT

I solve the problem. It was the number in the file.

The first attribute definition in the file must have the header [attr#0], the second attribute definition in a file must have the header [attr#1], and so on. A break in the numbering causes CSUtil.exe to ignore attribute definitions at the break and beyond. For example, if a file with 10 attribute definitions the fifth attribute is defined as [attr#5] instead of [attr#4], CSUtil.exe ignores the attribute that is defined as [attr#5] and remaining five the attributes following it.

Re: NAC attribute definition File

t3watts33 — Fri, 08 Sep 2006 12:48:34 GMT

Yes, your correct about that attr#. We figured this out the other day. The adf must begin with attr0