NAC Web agent - OS/Application compatibility

[gtilburg]

hi

I am trying to understand the requirements / compatibility for the Cisco NAC Web Agent 4.9.5.7 and the Windows OS/Browser/Applications.

The release notes don't discuss this in detail and the only relevant doc I managed to find, discusses the web agent for 4.5 instead of 4.9.

Any updates on this document?

Support Information for Cisco NAC Appliance Agents, Release 4.5 and Later - Cisco 

Many thanks

Gert

[hslai]

See Client Machine Operating Systems and Agent Support in Cisco ISE

[gtilburg]

Thanks Hsing-tsu,

The notes indicate the supported browsers (ie 7-9, ff 20.x,..) but these days we are on a firefox 49 and later. IE is at 11.

Are these versions supported? Can the doc be updated?

What about java/ActiveX?

Which java version is supported? Any security settings to be configured for java or ActiveX?

Many thanks

Gert

[hslai]

IE and Firefox are regularly tested by our teams. IIRC we stopped listing the browser versions because of too many of them. Any known issues are in the foot notes sections of the tables; e.g. note #15 says,

Cisco NAC Agent and Cisco NAC Web Agent do not support Google Chrome version 45 and later. See CSCuw19276 for more information. We recommend that you use another supported browser such as Internet Explorer 7.0, 8.0 or 9.0 or Mozilla Firefox 3.5.7, 3.6 or 20.x.

Same goes ActiveX and Java.

[gtilburg]

Hi Hsing-Tsu,

Sorry to be difficult about this, but the documentation is quite confusing:

-        The tables indicate Windows 7 with supported browsers 10 and 11, while in the notes we refer to 7,8,9.

-        Java and ActiveX settings are not mentioned anywhere. If I recall correctly, the security settings of the browser should be configured to allow to run Java/ActiveX and also the Java security settings were also to allow unsigned applications.

It is these types of settings that the customer would like to have a listing of to put it forward as requirements for their end users.

Many thanks

Gert

Gert Tilburgs - CCIE R&S 21187

Network Consulting Engineer

Cisco Security Services

[hslai]

The reference on IE 7, 8, and 9 is at foot-note 17. Right? I will file a doc bug to get it cleaned up.

The security settings you might have referred to are likely related to download and install NAC agent and supplicant provisioning or some bugs, for example,

CSCum76079 Client JAR manifest missing Permissions attribute & blocked by Java 7u51

CSCup93025    Error when running java applet for Cisco Web Agent on end client (IE10).

The following is a known issue with some version of Java but appears to work with later ones:

CSCuy87428 Guest flow "VLAN DHCP release"/Web agent download crash on Firefox (Java 1.8.0u77)

Lastly, Firefox 64-bit on Windows does not support the Java plug-in any longer. See NPAPI Plugin Perspectives and the Oracle JRE (Java Platform Group, Product Management blog)

[gtilburg]

Many thanks Hsing-Tsu,

That last comment does surprise me. Does that mean that users with FF 64bit will not be able to use the NAC Web agent?

Not sure how common FF 64bit is though..

Gert Tilburgs - CCIE R&S 21187

Network Consulting Engineer

Cisco Security Services

Phone: +3227046188 - Email: gtilburg@cisco.com

For corporate legal information go to:

http://www.cisco.com/web/about/doing_business/legal/cri/index.html

[hslai]

https://blog.mozilla.org/futurereleases/2015/12/15/firefox-64-bit-for-windows-available/ shows it offered since Dec 2015. ESR channel latest (45.x.x) offers both 32-bit and 64-bit Windows binary installs.

CSCva93708 is the doc bug filed on the foot note 19.

[gtilburg]

Sorry to get back to this, but is Cisco recommending any settings/versions for Java?

Our customer is asking what is supported to ensure that their clients don't run into issues. (a set of system requirements). So if certain Java versions require different settings, then we should be able to provide them.

Thanks

Gert

[hslai]

The latest Java should work with the default settings. Anyway, it would ask for permissions to allow the java app to run.