Implementing NAP and NAC Security Technologies: The Complete Guide to Network Access Control

7.2. The Technical Components of the Cisco NAC Framework

As discussed in Chapter 2 and Chapter 6, all NAC/NAP solutions consist of the same basic elements. Not all NAC/NAP solutions will contain all of the elements, and some vendors will be better at some elements than others. This section analyzes the following NAC components as they relate directly to the Cisco NAC Framework:

• A technology to analyze the security posture of the device

• A policy-related component to configure and set the policy on what specific security criteria will be analyzed on the device

• A technology to communicate the security state of the device to other facets of the NAC/NAP solution

• A mechanism that receives the security posture of the device and performs an action based upon those results

• A policy-related component to configure and set the policy regarding what action will take place

• A remediation technology whose purpose is to bring the device back into compliance

7.2.1. Analyzing the Security Posture of a Device

There are two methods by which the security posture of a device can be assessed:

• Client — Cisco Trust Agent (CTA) and vendor-specific posture plugins (PPs) are installed on each device accessing the network.

• Clientless — No assessment software is installed on a device accessing the network. Cisco refers to these types of systems as NAC Agentless Hosts (NAH).

As mentioned previously, client-based analysis can reveal much greater detail than clientless analysis. With this solution, it's important to ...