ISE - NAC agent profile

[eng.malak]

Dears

I want to deploy NAC agent via GPO and I need to create agent profile , I know how to create it on ISE but how i get the file in xml format to be distributed ?

[Octavian Szolga]

You can deploy a NAC Agent Profile to all your domain users using ISE itself (Client Provisioning).

Even though the rule will also provision domain users with NAC Agent client itself (mandatory), the users won't be able to install it manually.

Still, any other settings related to NAC Agent functionality (xml file, customization settings, etc) will be applied for that specific user and will be persistent.

[Eduardo Aliaga]

Hi. You must put the NACagentsetup-win-4.9.xxx.msi and the NACAgentcfg.xml in the same directory and share it with all the machines you want to deploy .

Then you can trigger remotely the following installation command.

msiexec.exe /i \\sharedfolder\NACAgentSetup-win-4.9.0.51.msi /qn /l*v c:\tempNAC\agent-install.log

There are lots of ways and Windows tools to trigger that command remotely. For example you could use "pstools".

http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx

Please rate if that helps.

[eng.malak]

Dears

My question is about how to get and customize the agent profile in xml format to put it with installer in the same directory

[Eduardo Aliaga · Accepted solution]

You can try installing only one PC (either by manual installation or by captive portal). If you have configured the posture rules in ISE then the NAC Agent automatically contacts the ISE server and downloads the last NACAgentcfg.xml available.

Then you could browse the following directory and find the NACAgentcfg.xml file in your PC.

C:\Program Files (x86)\Cisco\Cisco NAC Agent

After that you can mass deploy the NAC agent along with the xml file. Although is not mandatory to deploy the xml file  because as a I said, every time there's a posture rule the NAC agent will download the last NACAgentcfg.xml available from ISE server.

Please rate if it helps.

[Venkatesh Attuluri]

Chek this link it may be of help, its related to Creating Agent Customization Files

http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_client_prov.html#wp1217482