NAC Manager (CAM) Backups

Background:

The Cisco NAC Manager is the brain of the Cisco NAC solution. All configuration is stored in a database which makes the solution scalable. With that said, a crucial step in any deployment is developing a backup plan to ensure that if the NAC Manager or Failover Pair fails(Hardware failure, database corruption, administrator configuration mistake, fire, flood, sinkhole, etc.) the database can be restored and everything will be back up and working!


What gets backed up:

Everything that is stored in the database gets backed up. The following is a list of items that get backed up:

o Clean Access Server Configuration information (DHCP, Managed Subnets, VLAN Mapping, Static Routes, filters, etc.)
o Filters (Device Filters, Subnet Filters)
o Posture Assessment (Checks, Rules, Requirements,etc)
o Switch Management
o User Management (User Roles, Auth Servers, User Pages, Admin Users)
o Reports
o Licenses


What doesn't get backed up:

The less talked about item is what is not backed up. The following is a list of things that must be backed up manually during deployment and are not included in the database backup:

o Initial Configuration Information (service perfigo config) for the Managers and Servers. This means that good documentation of the initial network placement and ip addresses is a MUST.
o Failover Configuration (Good documentation will be the solution)
o Certificates (This is the #1 forgotten piece of information) Make sure to backup the private keys, root certificates, and CAM/CAS Certificates


Manual Backups:

The NAC Manager supports manual backups by going to administration -> backup, name the snapshot and hit "Create Snapshot". The snapshot may be downloaded to the local pc, if desired.

Figure 1 – Manual Backups

Automatic On-Box Backups:

The NAC Manager automatically creates daily snapshots of the Clean Access Manager database and preserves the most recent from the last 30 days. It also automatically creates snapshots before and after software upgrades, and before and after failover events. No configuration is required to enable these automatic backups. These backups are stored at /perfigo/backup directory.

Figure 2 – Automatic On-Box Backups

Automatic Off-Box Backups:

The first two methods are great, but what happens if the CAM gets caught in a fire? This is why creating a backup strategy to include automatically sending backups to another device that will not take the same hit as the CAM(Think different location) is vital. Cisco has provided a script located on the CAM(/perfigo/control/bin/) called pg_backup that will take a database backup and send it to an external FTP server. The following is a list of procedures to use the pg_backup script to send your DB backup to a ftp server nightly(See example for details):

o Login to the CAM as root
o cd /perfigo/control/bin
o Test using the pg_backup script
o Create a crontab file to use with cron (Example shows running pg_backup every morning at 2:30am)
o Import the crontab file
o Verify the file imported correctly

Figure 3 – Automatic Off-Box Backups

If ftp is not available within an organization SCP/NFS/SFTP may be utilized by creating a custom backup script or hiring a consultant to create one for the organization. Also, please note the pg_backup script names the file "csdb.gz". In order to keep multiple backups, create a backup rotation script on the ftp server or modify pg_backup to include a date.

Summary:

Backups are vital to ensuring NAC will be up and running quickly through any failure. Be sure with any deployment a strong backup strategy is included.

Sources: CAM Installation & Configuration Guide v4.1.3

Coming Up Next: Restores

Happy Cisco-Live week to everyone attending in Orlando and make sure to sign up for the NAC Deployment or NAC Troubleshooting session.

Cisco NAC Guest Server 1.1.1

On June 9th, Cisco posted an update to NAC Guest Server.



Version 1.1.1 comes with a few new features:

Guest Role Support
Guest Role Support provides the ability for Sponsors to create guest accounts with different privileges. This includes provisioning into different roles on the Clean Access Manager, returning different RADIUS attributes to RADIUS clients or only allowing access from specified networks.

Additional NTP Server
The 1.1.1 release introduces the ability to configure two NTP servers instead of a single NTP server in 1.1.0.

FTP Backup Directory
The 1.1.1 release allows a directory to be specified as part of the scheduled FTP backup, prior versions placed the backup in the default directory of the FTP user account.

As with all NAC related upgrades make sure to read the RELEASE NOTES before upgrading!

The NAC Guest Server Installation & Configuration Guide 1.1.1 can be used for reference of the new features.

Finally to download the new version go to the NAC Guest Server Download Page. (Requires Valid CCO Login)

New Configuration Examples

Cisco posted two new Configuration Guides:

NAC: LDAP over SSL on the Clean Access Manager (CAM)
This example will walk you through using SSL with your LDAP Auth Server.

NAC: LDAP Integration with ACS Configuration Example
This example will explain how to use Cisco NAC Profiler for MAC Auth Bypass(MAB) for 802.1X deployments.

To see all the previous Configuration Examples and TechNotes

Cisco NAC with IP Phones

Background:

One question that many people ask is how to deal with IP Phones during your NAC Deployment. Well the easy answer is "it depends", but what does it really depend on...

Identify all of the phones:

To find all of the phones on your network you may manually go through your Call-Manager or other Voice Server and export a list or utilize Cisco NAC Profiler to find all the phones. Please note that you must keep an updated list of all IP Phones in the CAM Device Filter Table in order for NAC to exclude the phones.

Determine your NAC deployment type:

When deploying an In-Band (IB) NAC Deployment, handling phones is very simplistic. One deployment option is when all of the phones are on a Voice VLAN they should bypass NAC. Meaning if the voice VLAN is NOT be bridged or routed through the CAS, the phones will never go through NAC. Another possibility, is the phones are on the same VLAN as users.(Please note it is a best practice to separate your voice devices from data devices for security reasons and also performance/QoS). If you do have data and voice merged and you have an IB deployment, then identify all phones' MAC Addresses and add them into the Device Filter Table as an "Allow Filter". This allows the MAC Addresses of the phones to go through the CAS without authentication or posture assessment.

Figure 1 - Allow Filter for a phone (IB deployment with Data/Voice Combined)

When deploying an Out-of-Band (OOB) NAC deployment, there are a few more things to think about. OOB works by setting a port's VLAN to an authentication/quarantine VLAN during the NAC process and then changing the VLAN to an access VLAN after the user is finished. When PCs are plugged into phones, you must ensure a few basics are covered.

Don't miss a call, even when NAC is deployed:

The first basic step required to make sure NAC does not interfere with phones is to ignore all traps regarding phones plugging in. This is done, by adding in a device filter with the type "ignore" into the CAM. Please note that this configuration is regardless of the vendor/type of phone.

Figure 2 - Ignore Filter for a phone (OOB deployment)
The next step is to ensure that all port profiles being used do not bounce the port for OOB. If the CAM bounces the port then the Phone in front of the PC will get rebooted which will then cause missed calls,etc.

If you ensure these two steps are performed, then deploying NAC with phones is going to be easy.

Behind the scenes:

Cisco NAC Appliance may be deployed with most any type of phone. The key is to understand how NAC works. There are two basic ways to configure a switchport with a PC and a Phone:

Switchport with a Cisco IP Phone or other vendor IP Phone using CDP:

interface gigabitethernet 0/1
switchport mode access
switchport access vlan 10 <--- This is the VLAN NAC will change switchport voice vlan 11 <-- NAC will NEVER change this VLAN With this deployment type, NAC will never modify the voice VLAN thus never affect the phone. Switchport with an Avaya IP Phone or other vendor IP Phone using Trunking:

interface gigabitethernet 0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10 <--- This is the VLAN NAC will change In this example, the phone will be tagging its frames on the Voice VLAN and the phone must pass the PC's frames through untagged. This ensures that the CAM can change the native VLAN of the port which will force the PC to either go through NAC or not. Summary:

Hopefully this answers everyones questions of how to deploy Cisco NAC Appliance with IP Phones. Keep the questions coming(JSanbower@hotmail.com) and I will be sure to keep posting!