Cisco Cisco NAC Appliance 4.8.4 Information Guide
© 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
Page 2 of 9
Q. How does the Cisco NAC Appliance fit with Cisco Security Agent?
A. Cisco Security Agents reside on each endpoint, protecting them from day-zero attacks through host intrusion
prevention technology. The Cisco NAC Appliance focuses on security policy enforcement - making sure that
each endpoint meets the security policy requirements before access is granted. The two solutions are
complementary: The Cisco NAC Appliance can help enforce that Cisco Security Agent is running on the
endpoint device.
Q. How can I talk to a Cisco NAC Appliance customer?
A. Please contact your Cisco sales representative to facilitate a conversation with a customer.
Cisco NAC Appliance Components
Q. What are the components of the Cisco NAC Appliance?
A. The Cisco NAC Appliance comprises three components: the Cisco NAC Server, Cisco NAC Manager, and
optional Cisco NAC Agent. As part of the product, customers also receive constant updates of the latest rule
sets and checks.
Q. Which components do I need for a deployment? Are Cisco NAC Agents sold on a per-seat basis?
A. You will need at least one Cisco NAC Manager and one Cisco NAC Server. One Manager can manage
multiple Servers. Cisco NAC Agents are not sold on a per-seat basis - they are free.
Q. How do I size a Cisco NAC Appliance deployment?
A. The number of online, concurrent users in a deployment determines the type and quantity of Cisco NAC
Servers required. In turn, the type and quantity of Cisco NAC Servers determines the type of Cisco NAC
Manager required.
Q. Is there an ongoing cost to receive new updates, vulnerability lists, etc.?
A. For a customer that holds a valid Cisco support contract, the updates are included in the current maintenance
cost.
Q. What is a “failover bundle”? How should it be used?
A. A failover bundle contains two Cisco NAC Servers or Managers. This provides redundancy in the event that
the production server experiences a disruption. Cisco recommends that all NAC Appliance products include
failover.
Q. Are both the Manager and Server required even for small installations?
A. Yes. Both components are required for all installations. Cisco NAC Managers are available to support 3, 20,
or 40 NAC Servers. Servers are available in 100-, 250-, 500-, 1500-, 2500-, 3500-, and 5000-user sizes.
How the Cisco NAC Appliance Works: General
Q. How does the Cisco NAC Appliance work?
A. When a device attempts to log onto the network, the Cisco NAC Appliance requests authentication
credentials and identifies what kind of device it is. Depending on the role of the user, a posture assessment is
performed based on the requirements of the network. If the device is found to be noncompliant, the Cisco
NAC Appliance redirects the machine to a quarantine area where the user can perform the necessary
downloads to update the machine. The machine is then rescanned and, if compliant, is granted access to the
network.