Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Lauren Sullivan
08-18-2017
Stats
Member since
08-11-2005
46
Posts
38
Helpful
8
Solutions
05-02-2011
09:12 AM
Guide for creating custom antivirus definitions checks for NAC Manager
... View more
- Tags:
- cam
- cca
- clean_access
Labels:
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
02-08-2011
01:16 PM
02-08-2011
01:16 PM
Can you have one of the users logout (or reboot if you're doing AD SSO), log back in, and then immediately grab the NAC agent logs and send those to me (either upload them here or email me with the address in my profile)? To get the agent logs, go to Start > All Programs > Cisco > Cisco Client Utilities > Log Packager, and it'll make a CiscoSupportReport.zip file on the desktop. Thanks, Lauren
... View more
02-08-2011
01:12 PM
Those fake interfaces are used for the routing process, so they definitely need to be up and happy From the CAS CLI, could you please get me the outputs of the following commands: ifconfig more /proc/click/real_routing_table/table Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
02-08-2011
01:06 PM
02-08-2011
01:06 PM
Hi Xavier, Sounds like a loop. Check the switchports connected to the trusted and untrusted side of the CAS - I'm assuming you've got them set to trunks. If so, make sure there are no shared VLANs between the two ports, and make sure the native VLAN on each is set to a different garbage VLAN. So, for a quick example. Say you're mapping VLAN 500 to VLAN 5 and VLAN 600 to VLAN 6, and VLAN 998 and 999 are currently not being used on your network. trusted side switchport trunk native vlan 998 switchport trunk allowed vlan 5, 6 untrusted side switchport trunk native vlan 999 switchport trunk allowed vlan 500, 600 Of course, you'll also want to allow the management VLAN on the trusted side, too. One other thing - are you seeing any errors on the directly connected switch about those ports or the CAS MAC addresses? HTH, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
02-08-2011
12:57 PM
02-08-2011
12:57 PM
Hi Wyley, What screen does the agent get stuck on? The full network access screen? If so, one thing we've seen before is that if you have the "automatically close logoff screen after seconds" (under Device Management > Clean Access > General Setup > Agent Login > select the role) set to 0, it can occasionally cause problems. If that's the case, try setting it to 1 and see if that changes anything. HTH, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
02-08-2011
12:49 PM
02-08-2011
12:49 PM
Hi Daniel, It doesn't look like that's an option in the 4.1.2 line. You can configure this in 4.1.3 line, however - see the configuration guide here: http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/413/cam/m_ha.html#wp1040221 HTH, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
12-01-2010
10:51 AM
12-01-2010
10:51 AM
Hi Jaume, In pre-4.8 setups, there's no logout button. Basically, the design then was that once the user was in the access VLAN, they should no longer communicate with the CAS, and if they can't communicate with the CAS, they can't log themselves out. If the devices are directly plugged in to the switchport, you can use SNMP linkdown traps to remove them from the OUL, but if they're behind another device like an IP phone, pretty much the only option is to use a CDL timer. 4.8 introduced the OOB logoff feature, which will work as you described - that is, users stay in communication with the CAS even in the access VLAN, and can log themselves out either through the agent or by logging off of Windows. Here's some more information on that: http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/48/48rn.html#wp1105594 Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
12-01-2010
06:32 AM
12-01-2010
06:32 AM
Hi Ramraj, Ah - let me clarify a bit more. You can do web authentication (no posture assessment) with iPhones (or most other mobile devices), but can't install the NAC agent or NAC web agent. Are you able to see the user page on the iPhone now and authenticate, and then getting that agent prompt? If so, it sounds like you have the agent required for all OSs for that user role. So, under Clean Access > General Setup > Agent login, choose the user role, and then choose MAC_ALL as the OS. You'll want to uncheck "use ALL settings for the Mac OS X family" and then make sure "require use of agent" and "require use of Cisco NAC web agent" are both unchecked. If you are using the Mac agent for your OS X users, please make sure to then set the OS to MAC_OSX and check "require use of agent" there. Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
11-30-2010
11:58 AM
11-30-2010
11:58 AM
Hi Ramraj, That's the settings for the web agent, not the web client - annoyingly similar names, but totally different things For the web client, it's under Adminstration > User Pages > edit the page for MAC_ALL, and it's under the General tab. Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
11-30-2010
11:56 AM
11-30-2010
11:56 AM
I'm not Faisal, but.... Do you want to do additional authentication (like LDAP or such) or just based on the MAC address? If you want to do just via the MAC, you can add them to the filter list and then either set them to "allow" to just allow the traffic, "role" to put them in a specific role, or "check" to apply posture assessment and then put them in the role. If no other authentication servers are configured, users who weren't in the filter list would not be able to authenticate, and they would be stuck in the unauthenticated VLAN. Thanks, Lauren
... View more
11-30-2010
11:51 AM
Hi Bryan, Authentication 2010-11-30 09:13:36 [00:0B:6B:01:D6:A3 ## 10.122.18.97] lindsey.hunter - Logged out successfully This is a user being logged out based on something the user did - either logging out of the agent or, if you have "Logoff NAC Agent users from network on their machine logoff or shutdown" checked, by their computer logging off or shutting down. Administration 2010-11-30 09:11:25 [70:1A:04:8C:15:73 ## 172.31.156.78] bmcstudent - forcefully logged out by Administrator Authentication 2010-11-30 09:11:21 Unable to ping 172.31.156.78, going to logout user bmcstudent These two logs go together. It looks like you have a heartbeat timer set - so in this case, the earlier error (9:11:21) is the heartbeat timer expiring, and the latter is the user being logged out due to it. Heartbeat timers are configured under User Management > User Roles > Schedule, and basically just check using ARP that a user is still reachable. So if you have the timer set to 5 minutes, if the CAS doesn't get a response from the user for over 5 minutes, it'll log them out. Here's the section from the guide on heartbeat timers: http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/47/cam/m_trfpol.html#wp1047194 Does that make sense? Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
11-30-2010
11:42 AM
11-30-2010
11:42 AM
Hi Ramraj, It sounds like the user page is configured incorrectly - under the general tab for the MAC_ALL page, please make sure the "use web client" options are not checked. After that, the client should not be required to use Java to login. Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Security Documents
in Security Documents
11-18-2010
06:37 AM
11-18-2010
06:37 AM
Quick guide for adding in HA collectors to a standalone or HA Profiler
... View more
Labels:
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
11-18-2010
06:22 AM
11-18-2010
06:22 AM
Hi Tony, Are these just for internal users? If so, you may be better off with something like a internally generated cert (like from Microsoft CA) rather than an external one. I don't believe they'll do IP address-based certs, either. Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
in Other Security Subjects
11-18-2010
06:18 AM
11-18-2010
06:18 AM
Hi Yasmena, Basically you can use the same configuration for an LDAP authentication server as an LDAP lookup servr - the differences are that one is used for authentication (which you are already doing by using AD SSO) and one is for mapping purposes. So, if you're having problems with the mapping portion, you can duplicate the LDAP server and mappings as an authentication server, and then use the Auth Test to see what you're being mapped to. Thanks, Lauren
... View more
Created by
Lauren Sullivan
in Other Security Subjects
02-08-2011
02-08-2011
Can you have one of the users logout (or reboot if you're doing AD SSO),
log back in, and then immed...
02-08-2011
Those fake interfaces are used for the routing process, so they
definitely need to be up and happy F...
02-08-2011
Hi Xavier,Sounds like a loop. Check the switchports connected to the
trusted and untrusted side of t...
Created by
Lauren Sullivan
in Other Security Subjects
02-08-2011
02-08-2011
Hi Wyley,What screen does the agent get stuck on? The full network
access screen? If so, one thing w...
Created by
Lauren Sullivan
in Other Security Subjects
02-08-2011
02-08-2011
Hi Daniel,It doesn't look like that's an option in the 4.1.2 line. You
can configure this in 4.1.3 l...
Created by
Lauren Sullivan
in Other Security Subjects
12-01-2010
12-01-2010
Hi Jaume,In pre-4.8 setups, there's no logout button. Basically, the
design then was that once the u...
Created by
Lauren Sullivan
in Other Security Subjects
12-01-2010
12-01-2010
Hi Ramraj,Ah - let me clarify a bit more. You can do web authentication
(no posture assessment) with...
Created by
Lauren Sullivan
in Other Security Subjects
11-30-2010
11-30-2010
Hi Ramraj,That's the settings for the web agent, not the web client -
annoyingly similar names, but ...
11-30-2010
I'm not Faisal, but.... Do you want to do additional authentication
(like LDAP or such) or just base...
11-30-2010
Hi Bryan,Authentication2010-11-30 09:13:36[00:0B:6B:01:D6:A3 ##
10.122.18.97] lindsey.hunter - Logge...
Created by
Lauren Sullivan
in Other Security Subjects
11-30-2010
11-30-2010
Hi Ramraj,It sounds like the user page is configured incorrectly - under
the general tab for the MAC...
Created by
Lauren Sullivan
in Security Documents
11-18-2010
11-18-2010
Quick guide for adding in HA collectors to a standalone or HA Profiler
Created by
Lauren Sullivan
in Other Security Subjects
11-18-2010
11-18-2010
Hi Tony,Are these just for internal users? If so, you may be better off
with something like a intern...
Created by
Lauren Sullivan
in Other Security Subjects
11-18-2010
11-18-2010
Hi Yasmena,Basically you can use the same configuration for an LDAP
authentication server as an LDAP...
Public Statistics
| Date Registered | 08-11-2005 11:56 AM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 46 |
| Total Helpful Votes Received | 38 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 9 | |
| 5 | |
| 10 |
