Cisco NAC框架设计与架构详解

需积分: 4 193 浏览量更新于2024-08-02 3 收藏 3.31MB PDF 举报

《Cisco Press：Cisco Network Admission Control, Volume I - NAC Framework Architecture and Design》是一本由Denise Helfrich、Lou Ronnau、Jason Frazier和Paul Forbes编著的专业技术书籍，针对思科网络准入控制（Network Admission Control, NAC）框架提供深入的架构和设计指南。该书是Cisco Network Admission Control Release 2的核心参考资料，旨在帮助读者理解和实施NAC框架，确保网络安全和合规性。书中涵盖了以下几个关键知识点： 1. **版权声明**：本书享有2007年Cisco Systems, Inc.的版权，任何未经出版商书面许可的复制或传播行为，包括影印、录音以及任何形式的信息存储和检索系统，都是被禁止的，仅允许在书评中引用部分摘录。 2. **出版信息**：出版社为Cisco Press，地址位于美国印第安纳州印第安纳波利斯。首次印刷于2006年12月，印数为1234567890。同时，它还具有图书馆和出版物分类号2005923482。 3. **警告与免责声明**：作者、出版社和Cisco Systems, Inc.提供的信息基于“现状”原则，尽管书中尽最大努力保证其完整性和准确性，但并不承诺或担保其适用性或满足特定目的。所有内容仅供参考，使用者需自行决定如何应用这些信息，并理解可能存在潜在的风险和局限。 4. **NAC Framework架构与设计**：本书详述了NAC框架的设计过程，包括准备、规划和实施步骤。读者可以了解到NAC如何通过预定义的安全策略来控制网络访问，以防止未经授权的设备接入，确保网络环境的安全性，符合企业安全政策和法规要求。 5. **技术内容覆盖**：内容可能涉及NAC组件的详细分析，如策略服务器、客户端代理、准入控制设备（如交换机和路由器），以及如何配置它们来执行访问控制功能。此外，还会讨论NAC与其他网络基础设施的集成，如身份验证、授权和审计机制。 6. **实用性与实用性**：作为一本实践导向的教材，书中会提供实例、案例研究和最佳实践，以便读者能将理论知识转化为实际操作能力，应对不同场景下的网络准入控制需求。《Cisco Network Admission Control, Volume I》是一本针对思科网络准入控制框架的专业指南，适合IT专业人士、网络管理员和安全团队参考，帮助他们理解和部署有效的网络准入控制措施。

In Figure 1-2, the following process occurs:

1. A noncompliant host computer at the branch attempts network access. The network

detects that the host computer is out of compliance. The network infrastructure can deny

the host network access altogether or quarantine it so that remedial action can be taken

without impacting other hosts on the network. The action is under the system

administrator's control by means of admission and security policies that are defined by

the administrator.

2. The noncompliant host is quarantined and not allowed to access the entire network;

rather, it is redirected to a quarantine subnet, where a remediation server exists.

3. The spread of malware is circumvented, and other endpoints are not exposed.

By preventing noncompliant endpoints from joining the community at large, a potentially

dangerous new threat is avoided. For noncompliant users, resistance is futile; prepare to be

remediated!

NAC Benefits

NAC offers the following benefits to businesses:

• Protects corporate assets— NAC enforces the corporate security software compliance

policy for endpoints.

• Protects against business disruptions— This applies to productivity in the infrastructure

and employees. Starting your day with an infected computer and dealing with the loss of

precious data are frustrating and require time to recover from. NAC limits this disruption

by minimizing the occurrence of infections in the network.

• Provides a return on investment (ROI)— NAC Framework increases the value of existing

Cisco network infrastructure by using what is already in place; in many cases, upgrading

the software adds new security features like NAC. Another ROI for NAC Framework is

ensuring that network computers are using the existing security applications, such as

antivirus, and are compliant with the latest update.

• Reduces operating costs— NAC frees technical staff from the firefighting mode of

containing infections and cleaning endpoint devices one by one.

In summary, NAC benefits businesses by proactively protecting corporate assets, reducing

business interruptions from malware, and freeing desktop services staff from reacting in a

firefighting mode. NAC can also provide a return on investment by using existing Cisco network

infrastructure to enforce compliance, while ensuring that existing NAC vendor security

applications are being used accordingly.

The next section describes the major components of NAC Framework.

NAC Framework Components

provide additional identity-based services. For a list of NAC program partners, refer to

the "Cisco Network Admission Control Program" link at http://www.cisco.com/go/nac.

Cisco has licensed the trust agent technology to its NAC partner vendors so that it can be

integrated with their security software client products. The trust agent technology is free

and integrates with the CSA.

• Network access devices (NADs)— Network devices that enforce admission control

policy include Cisco routers, switches, wireless access points, and security appliances.

These devices demand host security credentials and relay this information to policy

servers, where network admission control decisions are made. Based on customer-defined

policy, the network can enforce the appropriate admission control decision for each

endpoint: permit network access, deny network access, redirect to a quarantine zone, or

restrict from specific subnets.

• Policy server— Server that evaluates the endpoint security information relayed from

NADs and determines the appropriate admission policy for them to enforce. The Cisco

Secure ACS is the Cisco policy server, which is the foundation of the policy server

system and is a requirement for NAC Framework. Optionally, ACS works in concert with

NAC-supported vendor policy servers to provide deeper credential validation capabilities,

such as identity servers (for example, a directory server database) and posture servers (for

example, antivirus policy servers). The vendor policy server communicates the vendor's

credential compliance status to Cisco Secure ACS, which makes the final determination

regarding the admission policy for the endpoint. Another optional policy server is an

audit server. A NAC-compatible audit server can determine the posture credentials of an

NAH, removing reliance on a posture agent being present on the host. This audit server is

especially useful for evaluating endpoints that are not managed by the business and those

devices that are not NAC compatible that need access to the network.

In addition to the required NAC components, a management system is recommended to manage

and monitor the various devices. Reporting tools are available to operation personnel to identify

which devices are compliant and, most importantly, which devices are not compliant

NAC Framework Requirements

At the time of this writing, the mandatory requirements for the NAC Framework solution are

Cisco Secure ACS, NAC-enabled NADs, and Cisco Trust Agent.

ACS is the only authentication, authorization, and accounting (AAA) server that has the

necessary logic to handle the NAC posture validation process. NAC support began with ACS

version 3.3.

The hosts should have Cisco Trust Agent installed to fully participate in the NAC Framework

solution, and a network device must be capable of supporting NAC acting as a NAD.

Optional pieces of the NAC Framework solution include many different NAC-enabled

applications installed on a host, external policy servers that can integrate with the application-

Cisco VPN 3000 Series Concentrators also support NAC over their remote-access virtual private

network (VPN) solutions running version 4.7 with IPsec only.

Wireless Support

Support for Cisco wireless access points, service modules, and client devices include the

following:

• Cisco Aironet access points deployed autonomously in standalone or Wireless Domain

Services (WDS) mode—Cisco Aironet 1100, 1130AG, 1200, 1230AG, 1240AG, and

1300 series access points running Cisco IOS Release 12.3(7)JA or later.

• Cisco Aironet lightweight access points deployed with a Cisco Wireless LAN Controller

(Cisco Aironet 1000, 1130AG, 1200, 1230AG, 1240AG, and 1500 series access points

and Cisco 2000, 4100, or 4400 series Wireless LAN Controllers as well as the Cisco

Catalyst 6500 series WiSM and Cisco Wireless LAN Controller Module for Integrated

Services Routers) running Cisco Unified Wireless Network Software Release 3.1 or later.

• Cisco Catalyst 6500 series Wireless LAN Services Module (WLSM) deployed as a WDS

device running Cisco IOS Release 1.4.1 or later.

• Any 802.11 Wi-Fi client devices with an IEEE 802.1X supplicant that supports NAC.

(Note: Cisco-supplied supplicant is for Ethernet adapter only, not WLAN adapter):

- Cisco Aironet client device with third-party NAC supplicant from Funk Odyssey or

Meeting House AEGIS client.

- Wi-Fi client device from third-party NAC supplicant providers such as Funk Odyssey

or Meeting House AEGIS client.

- Cisco Compatible client devices running version 4.0 or later. (Version 4.0 of Cisco

Compatible includes the required NAC supplicant.)

Cisco Secure ACS Requirements

Support for NAC release 1.0 began with ACS version 3.3, which supported NAC polices for

posture enforcement on endpoints. NAD enforcement was supported only on Cisco routers and

VPN concentrators with version 3.3.

NAC release 2.0 support begins with ACS version 4.0. This release began support for network

admission policies for posture and identity enforcement. NAD enforcement is supported on

Cisco routers, VPN concentrators, and Catalyst switches and Cisco wireless access points,

wireless controllers, wireless service modules, and wireless clients. Version 4.0 also supports the

use of audit servers to be part of the NAC policy decision.

Cisco Trust Agent Requirements

Cisco Trust Agent 1.0 became available with NAC release 1.0. Initially it supported some

Microsoft operating systems.

剩余224页未读，继续阅读

imliuli

粉丝: 233
资源: 1348

Cisco NAC框架设计与架构详解

Cisco.Press.Cisco.NAC.Appliance.Aug.2007.eBook-BBL

论文研究-Call Admission Control based on Adaptive Channel Reservation and Acceptance Factor in LTE System.pdf

Networkers2009：BRKUCT-2006 - Call Admission Control Design for Unified Communications

思科3825配置cisco3825配置实例借鉴.pdf

CDMA.rar_admission control_cdma软容量_control admission

Optimal Joint Session Admission Control in 3G/WLAN Integrated Network

admission-control:编写Kubernetes准入控制器的有用的微框架:magnifying_glass_tilted_right::admission_tickets:

Adaptive_Admission_Control_for_IoT_Applications_in_Home_WiFi_Networks.pdf

CAC.tar.gz_ACA_Admission_CAC_admission control_call admission

Residual resources aware distributed admission control mechanism in mobile multi-hop network

最新资源