Contents

These release notes provide late-breaking and release information for Cisco NAC Profiler, release 2.1.8. This document describes new features, changes to existing features, limitations and restrictions ("caveats"), upgrade instructions, and related information. These release notes supplement the Cisco NAC Profiler and Cisco NAC Appliance documentation included with the distribution. Read these release notes carefully and refer to the upgrade instructions prior to installing the software.

•Cisco NAC Profiler Releases

•System Requirements

•Software Compatibility

•New and Changed Information

•Known Issues in Version 2.1.8

•Use of "Custom API" Feature

•Configuration of Collectors on HA-CAS Pairs for Cisco NAC Profiler Release 2.1.8

•Caveats

•New Installation of Release 2.1.8

•Upgrade Instructions for Release 2.1.8

•Documentation Updates

Cisco NAC Profiler Releases

System Requirements

This section contains the following:

•Licensing

•Hardware Supported

Licensing

For general information on licensing for Cisco NAC Profiler Server and Cisco NAC Profiler Collector see Cisco NAC Appliance Service Contract / Licensing Support.

Note Refer to CSCsk25865 for additional details.

Hardware Supported

The Cisco NAC Profiler system consists of a Cisco NAC Profiler Server appliance or Cisco NAC Profiler Lite appliance, and one or more Cisco NAC Profiler Collectors that run on the Clean Access Server appliances (NAC-3310/3315 or NAC-3350/3355) deployed as part of the Cisco NAC Appliance system.

The Cisco NAC Profiler Server appliances leverage the Cisco NAC Appliance 3350 and 3310 hardware platforms only.

Cisco NAC Profiler Server

The Cisco NAC Profiler Server appliance is based on the NAC-3350 hardware platform and is pre-installed with a default version of the Cisco NAC Profiler Server software.

Cisco NAC Profiler Lite

The Cisco NAC Profiler Lite appliance is based on the NAC-3310 hardware platform and is also pre-installed with a default version of the Cisco NAC Profiler Server software. Profiler Lite is supported starting from release 2.1.8-37 only and requires a separate ISO file. Refer to New Installation of Release 2.1.8 for details.

Cisco NAC Profiler Collector (on CAS)

A default version of the Cisco NAC Profiler Collector component is included as an RPM service on the Clean Access Server (CAS) appliance starting from Cisco NAC Appliance release 4.1.2.1 and later. The Clean Access Server operates on NAC-3310/3315 and/or NAC-3350/3355 SERVER Appliance platforms only.

Note For proper operation, both the Cisco NAC Profiler Collector component on the CAS and Cisco NAC Profiler appliance (Profiler Server or Profiler Lite) must run the same version of the Cisco NAC Profiler software. Refer to Cisco NAC Appliance/ Cisco NAC Profiler Compatibility Matrix for details.

Note You will need to upgrade the default version of the Collector shipped with the CAS software for compatibility with the latest Cisco NAC Profiler release 2.1.8. For details refer to Cisco NAC Appliance/ Cisco NAC Profiler Compatibility Matrix.

See New and Changed Information for details on the latest release builds.

For ordering information, refer to the Cisco NAC Profiler Ordering Guide.

Software Compatibility

This section describes the following:

•Cisco NAC Appliance/ Cisco NAC Profiler Compatibility Matrix

•Collector Support and CAS Deployment Modes

Cisco NAC Appliance/ Cisco NAC Profiler Compatibility Matrix

Table 1 shows Cisco NAC Appliance/Cisco NAC Profiler compatibility and software versions supported for each component of the Cisco NAC Profiler solution. For proper operation, both the Cisco NAC Profiler Collector component on the CAS and Cisco NAC Profiler appliance (Profiler Server or Profiler Lite) must run the same version of the Cisco NAC Profiler software.

Note To upgrade to the latest Cisco NAC Profiler 2.1.8 release, refer to Upgrade Instructions for Release 2.1.8.

Collector Support and CAS Deployment Modes

The Cisco NAC Profiler Collector application resides on each Clean Access Server. The Collector application is composed of the following modules: NetMap, NetTrap, NetWatch, NetInquiry, NetRelay. Table 2 details the features supported for each Collector module for each Clean Access Server deployment mode. A `Y' in the column for each of the operational modes indicates that the collection function is available with any caveats indicated by the note(s). `Selective' indicates that the collection function is available but subject to certain limitations that are outlined in the notes.

Determining the Software Version

You can determine the version of Cisco NAC Profiler components as follows:

•Cisco NAC Profiler Server Version

•Cisco NAC Profiler Collector Version (on CAS)

Cisco NAC Profiler Server Version

•SSH or Telnet to the Profiler Server and type rpm -q Profiler.

[root@profiler2 ~]# rpm -q Profiler

Profiler-2.1.8-39

•Or, for additional status, SSH or Telnet to the Profiler Server and type service profiler status. You will need to provide the root user password. For example:

[root@profiler ~]# service profiler status

Password:

Profiler Status

   Version: Profiler-2.1.8-39

  o Server      Running

  o Forwarder   Not Installed

  o NetMap      Not Installed

  o NetTrap     Not Installed

  o NetWatch    Not Installed

  o NetInquiry  Not Installed

  o NetRelay    Not Installed

Cisco NAC Profiler Collector Version (on CAS)

SSH or Telnet to the Clean Access Server machine running the Collector service and type service collector status.

[root@bcas1 beacon]# service collector status

Profiler Status

   Version: Collector-2.1.8-39

  o Server      Not Installed

  o Forwarder   Running

  o NetMap      Running

  o NetTrap     Running

  o NetWatch    Running

  o NetInquiry  Running

  o NetRelay    Running

New and Changed Information

This section describes enhancements added to the following releases of Cisco NAC Profiler:

•Enhancements in Cisco NAC Profiler Release 2.1.8-39

•Enhancements in Cisco NAC Profiler Release 2.1.8-38

•Enhancements in Cisco NAC Profiler Release 2.1.8-37

•Enhancements in Cisco NAC Profiler Release 2.1.8-33

Enhancements in Cisco NAC Profiler Release 2.1.8-39

Build 39 of Cisco NAC Profiler release 2.1.8 added two new features addressing recent developments in the use of Web User Agents by applications. There are no bug fixes in the 2.1.8-39 release. Details on the features added to 2.1.8-39 are provided in the following sections:

•Endpoint Database Cleanup Utility

•NetWatch Filtering for Web User Agents

Refer to the following updated sections for additional details:

•Open Caveats - Release 2.1.8-39

•Open Caveats - Documentation

•Known Issues in Version 2.1.8

•CAS/Collectors Running in Real IP Gateway Mode

•Upgrade Instructions for Release 2.1.8.

Endpoint Database Cleanup Utility

Web User Agents and TCP Open Ports attributes of endpoint identity are collected for endpoints within the MyNetwork range cumulatively. Therefore a given endpoint may have multiple TCP Open Port and Web User Agent attributes collected for them and stored in the NAC Profiler endpoint database. In NAC Profiler systems that have been in operation for some time analyzing endpoint data flows via NetWatch, it may be desirable to purge collected web user agent and TCP Open Port data once the profile rules are well established to decrease database size and improve Modeler performance.

Version 2.1.8-39 adds a utility to purge unused TCP Open Port and Web User Agent endpoint data from the NAC Profiler endpoint database when executed by the administrator.

When the utility is run, it first determines the TCP Open Port and Web User Agents being used in enabled endpoint profiles. TCP Open Port and Web User Agent Data matching rules in enabled Endpoint Profiles are excluded from the purge so that no profile transitions occur as a result of using the database cleanup utility. Only data of this type that does not match a rule in any enabled profile is purged.

To run the database cleanup utility, follow the steps below:

Step 1 Navigate to the Utilities tab and select System Summary. The system summary page displays a Cleanup Database button, new to the 2.1.8-39 build.

Step 2 Click the Clean Up database button, which will display a warning dialog box confirming that the user wants to proceed with the deletion of Web User Agent and that TCP Open Port data not used in enabled Profiles will be permanently deleted from the database.

Step 3 Click OK to proceed with the cleanup. Successful execution of the cleanup is indicated by messages appearing in the UI confirming the cleanup of TCP Open Port and Web User Agent data.

NetWatch Filtering for Web User Agents

Version 2.1.8-39 adds a filtering capability specific to Web User Agent collection by NetWatch.

The NetWatch module configuration has a new parameter in the UI that allows the specification of a Regular Expression. Web User Agents collected by NetWatch that contain a matching string will not be forwarded to the Server for addition to the endpoint database. This feature provides a mechanism for excluding web user agent collection for some of the new streaming media players used by the network television websites for streaming of programming. These players can result in the collection of a very large number of Web User Agents for endpoints used to view streaming media from these sites which provides little value for profiling.

Entering a RegEx in the User-Filter Field of NetWatch modules collecting traffic will result in the discard of web user agents that match the RegEx.

Enhancements in Cisco NAC Profiler Release 2.1.8-38

Build 38 of Cisco NAC Profiler release 2.1.8 was a general and important bug fix release for the Cisco NAC Profiler that addresses the caveats described in Resolved Caveats - Release 2.1.8-38. Release 2.1.8-38 is available as a software upgrade only for the Profiler Server, Profiler Lite and Collector component on the CAS. No new features are added; however release 2.1.8-38 included the following enhancement:

•Endpoint and Directory Timeout Unified Into Endpoint Timeout

Refer to the following updated sections for additional details:

•Open Caveats - Release 2.1.8-39

•Open Caveats - Documentation

•Resolved Caveats - Release 2.1.8-38

•Known Issues in Version 2.1.8

•CAS/Collectors Running in Real IP Gateway Mode

•Upgrade Instructions for Release 2.1.8.

Endpoint and Directory Timeout Unified Into Endpoint Timeout

Changes were made to the timeout implementation which is configured via the Server module configuration. Endpoint Timeout and Directory Timeout have been unified into a single Endpoint Timeout parameter with units of days. The functionality of Endpoint Timeout is as follows:

•When this value is other than 0, Profiler will track the age of endpoint data for each endpoint in the database. Endpoints that have not had a refresh of endpoint data in greater than the number of days specified in the Endpoint Timeout will have the IP binding, location information (switch, port) disassociated from the MAC in the database and learned profiling data for the endpoint is purged. The endpoint MAC is maintained in the database in a "retired" state.

•At the time of the timeout, if an endpoint is in a Profile with the "Allow Timeout" option set to yes, the endpoint will be removed from the Profile and the Endpoint Directory. If that Profile matched a NAC Event, the removal from the Endpoint Directory would result in a removeMAC operation on the CAM. In the case of LDAP integration, if the Profile was enabled for LDAP, the endpoint would be removed from the LDAP directory upon expiration of the Endpoint Timeout on the next LDAP sync. This is the behavior of the Directory Timeout in version 2.1.8 build-37 and earlier.

•In the Endpoints by Profile view, Profiles with the "Allow Timeout" option set to yes will no longer display endpoints that have not had a refresh of data within the Endpoint Timeout value and are in a retired state in the database. This change will correct an issue with deleted/disabled Profiles remaining in this view, if they contained endpoints that were timed-out while in the profile prior to it being disabled or deleted.

•Endpoints in the "unknown" (un-profiled) state upon expiration of the Endpoint Timeout will not be shown in the Endpoint Directory or when viewing endpoints by Profile as Unknown has "allow timeout" enabled implicitly. Unknown endpoints that are marked as retired will not be displayed in any Endpoint Console views.

•If an endpoint that has been timed-out in the Profiler database is reconnected to the network, the discovery and profiling process for that endpoint is the same as that for a new endpoint joining the network for the first time. The identity attributes of the endpoint must be observed by the Profiler and the endpoint profiled accordingly—profiling data for the endpoint collected by the Profiler previous to the timeout is not available for the profiling decision as it is cleared from the database when the endpoint is retired.

•Upon upgrade to the build-38 maintenance release, if the system had an Endpoint Timeout set (value in hours in previous builds) this value is ignored during the upgrade. If the Directory Timeout was enabled in the configuration prior to upgrade, this value will be carried forward and set as the new unified Endpoint Timeout value for the system.

•On systems with a Directory Timeout set to other than the default (0 = no timeout), any endpoint in the database that had not had a refresh of endpoint data within the number of days specified by the timeout was already marked as 'retired' in the database. Upon upgrade to 2.1.8-38, all endpoints that had been subjected to the Directory Timeout and placed in the retired state previous to the upgrade will be treated as described above: they will be removed from the Endpoint Directory and view endpoints by Profile views of the Endpoint Console, and searching on the MAC address of the endpoint will return no results.

Refer to CSCsv55509 for further information.

Enhancements in Cisco NAC Profiler Release 2.1.8-37

Build 37 of Cisco NAC Profiler release 2.1.8 is a general and important bug fix release for the Cisco NAC Profiler that addresses the caveats described in Resolved Caveats - Release 2.1.8-37.

This release also includes the following enhancements:

•LDAP Enhancement

•Advanced Rule Editor

Refer to Known Issues in Version 2.1.8 for additional details.

For upgrade instructions, refer to Upgrade Instructions for Release 2.1.8

LDAP Enhancement

Enhancements were made to the LDAP Synchronization code to further improve performance.

Advanced Rule Editor

User Interface was modified to increase the size of the window used for entering/editing Advanced XML rules. This provides additional space for creating and editing Advanced rules that extend to multiple lines. Refer to CSCso50683.

Enhancements in Cisco NAC Profiler Release 2.1.8-33

This section describes enhancements added for release 2.1.8, build 33 of the Cisco NAC Profiler software for the Cisco NAC Profiler Server and Cisco NAC Profiler Collector (on the CAS).

•Enhancements for HA CAS/Collectors and HA Profiler Servers

•Enhancements for "service collector" Commands

•LDAP Integration

•Bounce Port by MAC

•Profiler Server GUI Enhancements

•HA Usability Enhancements

•Database Restore Enhancements

•NetMap Module Enhancements

•Clear Endpoint Enhancements

•MAC Vendor Database Updates

•FlexLM License Enhancements

•Restore Factory Defaults

Enhancements for HA CAS/Collectors and HA Profiler Servers

Release 2.1.8-33 of Cisco NAC Profiler adds required functionality to support high availability (HA) CAS/Collectors deployed with the Cisco NAC Profiler Server in standalone and HA modes using the `Server' connection type. Collector configuration allows for the selection of a name for the HA-CAS pair (both appliances), and the ability to specify one or more addresses of the Profiler Server using the `service collector config' command to allow the Collector service to accept connections from standalone and HA Profiler Servers.

Refer to Configuration of Collectors on HA-CAS Pairs for Cisco NAC Profiler Release 2.1.8 for specific instructions to configure HA CAS/Collectors deployed with standalone and HA Profiler Servers.

Enhancements for "service collector" Commands

service collector verify

The `service collector' command set has a new option `service collector verify' that shows current configuration of a Collector for verification of current settings without entering configuration mode.

service collector config

The `service collector config' command has been modified so that the value shown in brackets after each configuration parameter is either the current value of that parameter, or the default if not configured previously. In previous versions, only the default value was shown, not the current value of the parameter.

LDAP Integration

Cisco NAC Profiler release 2.1.8-33 substantially improves implementation of LDAP (Lightweight Directory Access Protocol), which allows the system to be queried by external systems such as RADIUS authentication servers. With this release, the Profiler Server includes an onboard LDAP directory which automatically synchronizes with LDAP-enabled Profiles in the Profiler endpoint database. Refer to the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8 for an overview of enhancements and LDAP system configuration.

Bounce Port by MAC

Cisco NAC Profiler integration with Cisco NAC Appliance now features the ability to force endpoints as they are Profiled into a Profile that matches a NAC Event to be re-provisioned by Cisco NAC Appliance immediately upon being Profiled. This allows endpoints previously undiscovered by the Profiler Server (e.g., new printer added to the network) to be discovered, profiled, and re-provisioned by Cisco NAC Appliance such that they get the proper network access with no manual intervention.

Refer to Use of "Custom API" Feature for details on the use/configuration of this option.

Profiler Server GUI Enhancements

Release 2.1.8-33 includes several enhancements to the Profiler Server web administration interface.

Utilities Tab > System Summary

•Clicking the `Display Server Log' button displays the Server.out file with last entry at top, and log entries are now date/time stamped.

•Clicking new button `Download DB dump' creates a database (configuration and endpoint data) backup and copies it to a specified off-appliance location in a single operation.

•Clicking new button `Collect Technical Logs' collects all technical log files in a single compressed archive and copies them to a specified off-appliance location in a single operation.

•The Edit Collector form adds a Refresh button which when clicked refreshes the status of Collector Component Modules without leaving the page.

•Network Device Import from CSV now supports bulk import of network devices running SNMPv3. For details, refer to the "Adding Network Devices to the NAC Profiler Configuration" chapter of the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8.

HA Usability Enhancements

Release 2.1.8-33 includes several enhancements to the usability of the High Availability (HA) option for the Cisco NAC Profiler Server. Several automation scripts are added that enhance the following Profiler Server HA operations:

•Adding HA to an operational standalone Profiler Server

•Temporarily disabling HA on an operational HA Profiler Server

•Permanently removing an HA Profiler Server configuration

•Automated reconfiguration of HA on a Profiler Server pair after permanent removal (e.g., resetting the HA configuration on a pair)

•Added automated replication of UI user accounts and passwords between HA systems.

•The Cisco NAC Profiler Server software upgrade script detects when it is being used to upgrade members of an HA pair and guides the user through the proper steps necessary for HA upgrade. This includes: upgrade the Secondary, perform automated failover of the system, then prompt for the upgrade of the former Primary appliance.

Database Restore Enhancements

Release 2.1.8-33 adds Profiler Server database restore scripts that can be used to restore the Profiler Server database of a Cisco NAC Profiler system from a database backup. The script is run from the command line and accepts the filename of the desired backup file (.gz format). You can run these scripts to automate the restore of the system configuration and endpoint database to standalone and HA systems from a backup. Running the script and specifying a backup file drops all contents of the Profiler Server database recreate and restore using the data in the backup file. In previous versions this operation had to be performed in multiple steps via the command line.

NetMap Module Enhancements

Release 2.1.8-33 implements automated checking of Network Devices in the Profiler system configuration for devices that have not been polled by the NetMap Collector component module in greater than 3 days. The new script can be run from the command line on the system hosting the Profiler Server and database to output a list of stale network devices to the console. The script checks the database for Network Devices (switches, routers) that have not been contacted by the designated NetMap module of the Profiler system in over three days.

Clear Endpoint Enhancements

The Clear Endpoint functionality has been changed to age-out all Profiling data about an endpoint when selected from the Summary Information page for a selected MAC or IP Address. Selecting Clear Endpoint for a given endpoint will result in the removal of all information about the device from the Profiler database requiring the endpoint to be re-learned in order for information about it to be presented by the GUI.

MAC Vendor Database Updates

The OUI (MAC Vendor) database for the Profiler Server has been updated.

FlexLM License Enhancements

FlexLM license upload has been modified on the Profiler Server to accept MAC addresses regardless of case. This addresses caveat CSCsk25865.

Restore Factory Defaults

A script has been added to the system to enable restore of the Profiler Server to factory defaults. Additional command line operations are outlined in the "NAC Profiler Server Command Line Reference" chapter of the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8.

Known Issues in Version 2.1.8

This section describes the following:

•Inference-Based Profiles

•CAS/Collectors Running in Real IP Gateway Mode

•Server.out Log

•Device Filter List on the CAM

Refer also to Open Caveats - Release 2.1.8-39 for additional important information.

Inference-Based Profiles

The "inference-based" Profiles, enabled by specifying Print Servers or Voice Gateways in the MyNetworks config, creates the Generic Printer and Generic IP Phone Profiles. The NAC Event logic does not match these Profiles, even if the regex matches the Profile name (e.g., /phone/i, /printer/i).

Workaround

Add Profiles named Generic Printer and/or Generic IP Phone Profile to the configuration (Create Profiles), then endpoints in these automatically created Profiles will be included in the synchronization.

CAS/Collectors Running in Real IP Gateway Mode

Real-IP Gateway and Collector modules enabled on a CAS with eth0 and/or eth1 configured for NetWatch are subject to an issue where HSRP duplicate frames are sent by the CAS in Real-IP Gateway mode with Collector NetWatch enabled on eth0. This causes HSRP issues and the default gateway to go down.

Eth0/NetWatch Workaround

The workaround is as follows:

•Use of eth0 and NetWatch concurrently is not supported.

•Configure eth2 or eth3 with an IP address to receive the IP helper packets and remove NetWatch/SPAN monitor for eth0 of the CAS Collector, as described in the following steps.

Step 1 Configure an unused interface (eth2 or eth3) of the NAC Server (CAS) collector via the CLI. For example:

a. cd to /etc/sysconfig/network-scripts

b. copy file ifcfg-eth0 to ifcfg-eth3 and edit (using VI)

c. cp ifcfg-eth0 ifcfpg-eth3

d. vi ifcfg-eth3

Note The IP Address configured for this interface needs to be a separate network from the eth0/eth1 interfaces on the NAC Server. If this is being set up for HA NAC Server Collectors, then you must also configure this interface via the CLI on the other NAC Server in the HA pair.

IPADDR=172.16.14.18

NETMASK=255.255.255.248

BOOTPROTO=static

ONBOOT=yes

PERFIGO_VLANPASS=

GATEWAY=

BROADCAST=

DEVICE=eth3

NETWORK=

Network routing needs to exist for this new network. The interface is not configured with a default gateway (so that the NAC Server routing is not confused/disrupted as a precaution). Since IP helper is sent UDP, a response is not needed. The client subnet is simply informing the Collector interface (running NetWatch) about the new DHCP requests and the Profiler is able to use this to get Client OS (DHCP Vendor) information used in profiling. You will not be able to ping this interface from the network since there is no default gateway. To troubleshoot and verify if the packets are being seen on the interface you can use tcpdump -i eth3.

Step 2 IP helper addresses configured on routed interfaces (SVIs) will need to point to the IP(s) of this interface (HA will have 2 separate IPs) for profiling of DHCP requests.

Step 3 Set up Collector NetWatch for this interface via the Profiler GUI:

a. Go to Configuration > NAC Profiler Modules > List NAC Profiler Modules and click on the appropriate Collector.

b. Under NetWatch Configuration, click Add Interface.

c. Type in the new interface name and choose the network(s) to match.

d. Click Add Interface, Save Collector, then Apply Changes and Update Modules.

See also CSCsm20254 and Collector Support and CAS Deployment Modes.

Server.out Log

The Server.out log viewable from the GUI does not collect all Cisco NAC Appliance synchronization messages, only a subset of these messages.

Follow the procedures specified in the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8 for viewing the NAC integration logs.

Device Filter List on the CAM

When Cisco NAC Profiler is integrated with Cisco NAC Appliance release 4.1(3), entries in the Device Filter List on the Clean Access Manager (CAM) made by the Profiler Server cannot be edited normally. Attempting to edit a Device Filter List entry made by the Profiler Server via synchronization will return a database error on the CAM.

Workaround

Add Profiles named Generic Printer and/or Generic IP Phone Profile to the configuration (Create Profiles), then endpoints in these automatically created Profiles will be included in the synchronization.If a Profiler-created Device Filter List entry on the CAM needs to be edited, the following procedure can be used:

1. On the CAM, navigate to Device Management > Filters > Devices > List, and click the Edit button for the Profiler-generated Device Filter entry.

2. In the Edit screen for the entry, select all the current text in the Description field and delete the description (click in the existing description text, CTRL-A, DEL).

3. Make any desired edits to the Device Filter entry, e.g.:

•Change Access Type (ALLOW, DENY, ROLE, CHECK, IGNORE)

•Add custom description, if desired, per normal guidelines as outlined in the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8.

4. Click "Save" to apply change

The next time the Profiler-NAC synchronization process runs, the description field will return to its normal form, unless the "*" prefix has been used. Refer to chapter "Integration with Cisco NAC Appliance" in the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8 for details.

Refer to CSCsm58145 for additional details.

Use of "Custom API" Feature

The Custom API option of the Server module NAC configuration (Configuration -> Profiler Modules -> Server -> NAC Configuration) should only be implemented in specific situations as described in this documentation, or as directed by the Cisco TAC. Whenever upgrading Cisco NAC Profiler or Cisco NAC Appliance software, carefully consult the release notes to determine if it is appropriate for the Custom API to be enabled.

The Custom API functionality was implemented to provide extensions to the Cisco NAC Appliance API for three specific scenarios:

•Scenario A: Cisco NAC Appliance 4.0, Access Types CHECK and IGNORE

•Scenario B: Cisco NAC Appliance 4.1.0, 4.1.1, 4.1.2, Out Of Band Deployments

•Scenario C: Cisco NAC Appliance 4.1.3, Out Of Band Deployments

Scenario A: Cisco NAC Appliance 4.0, Access Types CHECK and IGNORE

The API for Cisco NAC Appliance release 4.0 does not support Device Filter List access types CHECK and IGNORE. If either of these access types is to be used with NAC-Event-Rules, then the Custom API must be enabled, using patch file cca4_api_addmac.diff.

Scenario B: Cisco NAC Appliance 4.1.0, 4.1.1, 4.1.2, Out Of Band Deployments

For Out Of Band (OOB) deployments, switch port VLAN provisioning typically immediately enforces updates to the Device Filter List as soon as they are made. In other words, the assigned VLAN on a port should immediately be updated if a Device Filter List entry, which specifies the MAC address for an endpoint connected to the given port, is added, removed, or changed. For OOB deployments with Cisco NAC Appliance releases 4.1.0, 4.1.1, 4.1.2, the immediate enforcement of network access policy via Device Filter List changes does not occur. For example, if a printer is already connected to the network and a Device Filter List entry for the printer's MAC address is added, the printer is not immediately granted network access (nor is access immediately revoked if the Filter List entry is removed).

If this behavior is desired when running Cisco NAC Appliance 4.1.0, 4.1.1, 4.1.2, the Custom API must be enabled, using patch file cca41x_api_bounceport.diff.

Note This mode of Custom API use has been tested and approved for use with the following Cisco NAC Appliance releases:

•Cisco NAC Appliance 4.1.0, 4.1.1, 4.1.2

•If using release 4.1.0 or 4.1.1, patching of ssl.conf is required as described in Implementation Instructions, and Important Caveat.

Scenario C: Cisco NAC Appliance 4.1.3, Out Of Band Deployments

This scenario is similar to Scenario B: Cisco NAC Appliance 4.1.0, 4.1.1, 4.1.2, Out Of Band Deployments, but affect Cisco NAC Appliance 4.1(3).

For this scenario no patch file is utilized. For implementation, simply enable the Custom API checkbox in the Profiler Server Configuration as described in Step #2 in the implementation instructions below.

Note This mode of Custom API use has been tested and approved for use with the following Cisco NAC Appliance release:

•Cisco NAC Appliance 4.1.3

Implementation Instructions

For the following instructions:

•PATCH_FILE is the selected patch file named in the corresponding section

•CAM is the IP or DNS address of the Clean Access Manager system (VIP/service address for HA CAM pairs).

Perform the following steps to enable the Custom API.

•Prerequisite

•1. For Scenarios A and B ONLY: Patch API file

•2. For ALL Scenarios: Tun on Feature in Profiler Server UI

•3. Scenarios B and C on Cisco NAC Appliance 4.1.0, 4.1.1: Patch ssl.conf

•Important Caveat

Prerequisite

Configure Cisco NAC Profiler integration with Cisco NAC Appliance as described in the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8 before enabling the Custom API.

1. For Scenarios A and B ONLY: Patch API file

Log on to the Profiler Server via SSH as user beacon and perform the following commands.

Note Be especially careful with the last command.

1. profiler# cd /usr/beacon/etc 

2. profiler# scp root@CAM:/perfigo/control/tomcat/normal-webapps/admin/cisco_api.jsp 
cisco_api.jsp 

3. profiler# patch -b < cca_api/PATCH_FILE 

4. profiler# scp cisco_api.jsp 
root@CAM:/perfigo/control/tomcat/normal-webapps/admin/cisco_api_alt.jsp 

2. For ALL Scenarios: Tun on Feature in Profiler Server UI

In the Cisco NAC Profiler Server web interface, do the following:

Step 1 Browse to Server module configuration screen by navigating to Configuration-> NAC Profiler Modules->List NAC Profiler Modules->"Server"

Step 2 In the "NAC Configuration" section, enable the checkbox labeled Custom API

Step 3 Click Update Server

Step 4 Restart the Server module: Configuration->Apply Changes->Re-Model

3. Scenarios B and C on Cisco NAC Appliance 4.1.0, 4.1.1: Patch ssl.conf

Note This step is required for Scenario B: Cisco NAC Appliance 4.1.0, 4.1.1, 4.1.2, Out Of Band Deployments andScenario C: Cisco NAC Appliance 4.1.3, Out Of Band Deployments when the Cisco NAC appliance release is 4.1.0 or 4.1.1 only. This step is not required for release 4.0 or 4.1.2 and later.

Log on to the Profiler Server system via SSH as user beacon and perform the following commands:

1.      profiler# cd /usr/beacon/etc 

2.      profiler# scp root@CAM:/perfigo/control/apache/conf/ssl.conf ssl.conf 

3.      profiler# patch -b < cca_api/cca41x_ssl_conf.diff 

4.      profiler# scp ssl.conf root@CAM:/perfigo/control/apache/conf/ssl.conf 

5.      profiler# scp ssl.conf root@CAM:/perfigo/control/apache/conf/ssl_alt.conf 

6.      On CAM, execute these commands: 

7.      cam# /perfigo/control/bin/stopapache 

8.      cam# /perfigo/control/bin/startapache 

Important Caveat

This setup will stop being operational if either the CAM is rebooted or command `server perfigo restart' is executed on the CAM. If this happens, the following commands must be executed to restore the custom API to operational status.

cam# cd /perfigo/control/apache/conf/ssl_alt.conf 

cam# cp ssl.conf.patched ssl.conf ssl.conf 

cam# /perfigo/control/bin/stopapache 

cam# /perfigo/control/bin/startapache 

Note Upgrading to Cisco NAC Appliance release 4.1(2) or later removes the need for this CAM ssl.conf file workaround.

Configuration of Collectors on HA-CAS Pairs for Cisco NAC Profiler Release 2.1.8

Release 2.1.8 of Cisco NAC Profiler includes changes to the procedure for the configuration of CAS/Collector HA pairs deployed with standalone and HA Profiler Server pairs. Use the following procedure when deploying CAS/Collector HA pairs in a Cisco NAC Profiler system:

Step 1 Configure CASs for HA mode operation and verify that the HA protocol is operational. This step is critical to complete first to ensure that the HA protocol between the CASs is operating normally and the VIP is available for the Collector service configuration on both appliances in the CAS pair.

Step 2 Determine a name for the Collector service to run on the CAS pair. The name must be no greater than 24 characters, and a name that associates the Collector service on both members of the CAS pair is recommended such as "Building-26-CAS" for example. This name will be used in the Profiler Server configuration to identify the Collector service on the HA CAS Pair so that it can be managed via the GUI as a single Collector.

Step 3 Configure the Collector service on the primary CAS first by using the `service collector config' command.

a. Select yes when asked if you would like to enable the NAC Collector

b. Select yes when asked if you would like to configure the NAC Collector

c. Enter the name for the Collector service on the pair which was determined in Step 2.

Note An identical name for the Collector service must be used in the configuration on both CASs in the HA pair. Normally, the hostname of the CAS appliance is chosen by default when configuring a Collector. For release 2.1.8-33 and later, there is an option to specify a name for the Collector when using the `service collector config' command. When configuring CAS/Collector HA pairs, a name for the Collector service must be chosen and used on both appliances in the pair identically (e.g., case sensitive, spaces, etc.).

d. The Connection type for the Collector configuration must be set to `Server'. For CAS/Collector HA Pairs, the Profiler Server will have to initiate the connection to the Collector service running on the pair. This is accomplished by selecting the Server connection type for the CAS/Collector.

e. Listen on IP - the Collector should be configured to listen on the VIP/Service IP address assigned to the CAS HA pair during CAS HA configuration.

f. Enter the IP address(es) of the Profiler Server that will connect to the CAS/Collector:

1. For a standalone Profiler Server, this should be the IP address of the eth0 (management interface) of the Profiler Server. Enter the IP address of the eth0 interface, then type `done' when prompted for another address.

2. If the Profiler Server is deployed as an HA pair, the eth0 interface IP addresses of each Profiler appliance needs to be entered in this step along with the VIP/Service IP of the HA Profiler Server pair. Enter the IP address of the eth0 interface of the first Profiler Server appliance, press enter; enter the IP address of the eth0 interface of the other Profiler Server appliance in the HA pair, press enter, enter the VIP/Service IP address of the HA Profiler Server pair, then enter `done' to progress the script to the next step.

g. Enter the port number for the TCP connection between the Profiler Server and Collector—the default of 31416 is acceptable in almost all cases. The port number specified for the Collector must match that of the Network Connection specified for the Server module in Step 5.f.

h. Select the Encryption type for the connection between the Collector and the Profiler Server. Select `none' if no encryption is desired. The encryption type on the Collector must match that of the Network Connection specified for the Server module in Step 5.g.

i. Specify a shared secret if encryption was selected. If no encryption was selected, do not enter a shared secret. The shared secret for encryption on the Collector must match that of the Network Connection specified for the Server module in step 5.h below.

Step 4 Complete the steps outlined in Step 3 on the secondary CAS in the pair, ensuring that the parameters are entered identically for the second appliance as they were for the first member of the CAS HA pair.

Step 5 Create a Network Connection of type Client in the Server module configuration which will result in the Profiler Server initiating a connection to the VIP/Service IP address of the Collector service running on the HA CAS pair

a. Using the GUI, open the Configure Server form by navigating to the Configuration tab and selecting NAC Profiler Modules -> List NAC Profiler Modules. From the Server table, click on the Server link to display the Configure Server form and display the current Profiler Server configuration.

b. Scroll down to the Network Connections section of the form, near the bottom

c. Select the `Add connection' button to add a new network connection

d. For Connection Type: select the `client' radio button

Note When the Client radio button is selected, the add network connection form changes. Note that the Allow Connections From section is shown at the bottom of the form. For standalone appliances, this should be populated with the loopback address (127.0.0.1) and the IP address of the eth0 interface of the Profiler Server. For HA Profiler Server pairs, the loopback and the eth0 interface addresses of both appliances should be displayed.

e. Enter the IP address of the VIP of the CAS HA pair hosting the Collector service in the IP Address field.

f. Enter the TCP port number for the connection between Profiler Server and Collector. This must match what is configured on the Collector services running on both members of the HA pair (Step 3.g. and Step 4.g.)

g. Select the desired encryption type from the drop down. This must match what is configured on the Collector services running on both members of the HA pair (Step 3.h. and Step 4.h.)

h. Enter the shared secret for the encryption type selected—leave blank if no encryption was selected. The shared secret must match what is configured on the Collector services running on both members of the HA pair (Step 3.i. and Step 4.i.) if applicable)

i. Click on Add connection button to save new connection

j. Verify that the newly added connection now appears in the list of network connections for the Server module (Edit Server form), then click on Update Server to save the configuration.

Step 6 Add the Collector for the CAS pair into the Profiler Server Configuration via the GUI.

a. Click on Add Collector to open the Add Collector form

b. Enter the Collector Name in the field. The Collector name must match the name determined and configured for the Collector service running on both members of the CAS pair in Step 2. This ensures that Collector failover will occur automatically upon failover of the CAS service from one to the other member of the pair.

c. In the Forwarder Configuration section of the form, enter the following information to complete the configuration:

a. IP Address: enter the VIP/Service IP address of the CAS pair hosting this Collector service

b. From the Connection drop-down, select Listen for: Server (port: 31416 (or selected port number))

d. Select Add Collector to save the new Collector to the Profiler Server configuration

e. Select Apply Changes -> Update modules to restart the system.

After 3-5 minutes, the Server should establish the connection to the Collector service running on the active member of the CAS pair. Upon failover of the CAS, the Collector service will move with the CAS service to the active member of the pair along with the connection to the Profiler Server.

Caveats

This section describes the following caveats.

•Open Caveats - Release 2.1.8-39

•Resolved Caveats - Release 2.1.8-38

•Resolved Caveats - Release 2.1.8-37

•Resolved Caveats - Release 2.1.8-33

•Open Caveats - Documentation

•Resolved Caveats - Documentation

Note If you are a registered cisco.com user, you can view Bug Toolkit on cisco.com at the following website:

http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs

To become a registered cisco.com user, go to the following website:

http://tools.cisco.com/RPF/register/register.do

Open Caveats - Release 2.1.8-39

Note For Cisco NAC Appliance caveats that impact Cisco NAC Profiler, refer to the "Caveats" section of the applicable version of the Release Notes for Cisco NAC Appliance (Clean Access) at http://www.cisco.com/en/US/products/ps6128/prod_release_notes_list.html

INFO: [2008-05-02 15:48:44 (fcapGetHWAddr:91)]  Retrieving 
HWAddr for eth0  ERROR: (FlexLM): Unknown MAC 
->XXXXXXXXXXXX  ERROR: (FlexLM): No match found in -> 
[<Count>2</Count><PrimaryMAC>YYYYYYYYYYYY</PrimaryMAC>] 

[root@profiler1 ~]# service profiler status

Profiler Status

   Version: Profiler-2.1.8-37

  o Server      Running

  o Forwarder   Not Installed

  o NetMap      Not Installed

  o NetTrap     Not Installed

  o NetWatch    Not Installed

  o NetInquiry  Not Installed

  o NetRelay    Not Installed

echo "delete from beacon_component where name LIKE

'<collector name as it appears in the GUI>%';" | psql

Resolved Caveats - Release 2.1.8-38

Resolved Caveats - Release 2.1.8-37

Resolved Caveats - Release 2.1.8-33

Open Caveats - Documentation

service collector status 

service collector start 

scp PRIMARY_IP:/usr/beacon/config/cleanaccess.conf 

scp PRIMARY_IP:/usr/beacon/config/cleanaccess.conf 
cleanaccess.conf 

[root@cas1 beacon]# service collector verify

Collector Network Configuration

Collector Name    = cas

Resolved Caveats - Documentation

New Installation of Release 2.1.8

If performing a new CD installation of the Cisco NAC Profiler software on the Cisco NAC Profiler Server or Cisco NAC "Profiler Lite" Server, use the steps described below.

If performing upgrade on an existing Cisco NAC Profiler system, refer to the instructions in Upgrade Instructions for Release 2.1.8.

Note To support Cisco NAC Profiler release 2.1.8, your CAM and CAS must already be configured and running the latest supported Cisco NAC Appliance release (4.1.2.1 is the minimum) and the Collector component must be upgraded on the CAS to the appropriate version as described in Software Compatibility and Upgrading Collector Service on CAS.

Note The Profiler Lite appliance platform is supported starting from release 2.1.8-37 and later and requires a separate ISO file. Only the nac_profilerlite_2.1.8-37-K9.iso file (or later) can be installed on the Profiler Lite platform. See Hardware Supported and Software Compatibility for details.

Step 1 Follow the instructions on your welcome letter to obtain a license file for your installation. See Cisco NAC Appliance Service Contract/Licensing Support for details. (If you are evaluating Cisco NAC Profiler, visit http://www.cisco.com/go/license/public to obtain an evaluation license.)

Step 2 Log into the Security Software download site for Cisco NAC Appliance and download the latest Cisco NAC Profiler ISO image from http://www.cisco.com/kobayashi/sw-center/ciscosecure/cleanaccess.shtml

•For standard Profiler Server, download the latest nac-profiler_2.1.8-37-K9.iso

•For Profiler Lite, download the latest nac_profilerlite_2.1.8-37-K9.iso

Note Version 2.1.8-38 and 2.1.8-39 are available as software upgrade files only. See Upgrade Instructions for Release 2.1.8 for details.

Step 3 Burn the ISO as a bootable disk to a CD-R.

Step 4 Insert the CD into the CD-ROM drive of each installation server, and follow the instructions in the auto-run installer. Refer to the Installation and Initial Configuration chapter of the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8 for complete installation instructions for both standalone and high availability (HA) Profiler Servers.

Step 5 Log into the web console for the Profiler Server (default username/password: admin/profiler) and navigate to Home > Upload License to install license files for your Cisco NAC Profiler deployment. For details, refer to section "How to Obtain and Install New Cisco NAC Profiler Server/Collector Licenses" at http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/license.html#wp39197

Step 6 Upgrade the Collector component on each Clean Access Server to the appropriate version as described in Upgrading Collector Service on CAS.

Step 7 Continue the configuration of your Cisco NAC Profiler deployment from the Profiler Server web console as described in the Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8.

Upgrade Instructions for Release 2.1.8

This section provides instructions for how to upgrade the Cisco NAC Profiler Server and the Cisco NAC Profiler Collector component on the CAS to the latest version of the software.

Note To support Cisco NAC Profiler release 2.1.8, your CAM and CAS must already be configured and running the latest supported Cisco NAC Appliance release (4.1.2.1 is the minimum) and the Collector component must be upgraded on the CAS to the appropriate version as described in Software Compatibility and Upgrading Collector Service on CAS.

Note The Profiler Lite appliance platform is supported starting from release 2.1.8-37 and later and requires a separate ISO file. Only the nac_profilerlite_2.1.8-37-K9.iso file (or later) can be installed on the Profiler Lite platform. See Hardware Supported and Software Compatibility for details.

The upgrade instructions for the Cisco NAC Profiler Server include both standalone and HA-pair configurations and explain the HA Failover procedure.

•Overview

•Upgrading Profiler Server Standalone Systems

•Upgrading Profiler Server HA Pairs

•HA Failover Procedure

•Upgrading Collector Service on CAS

Overview

Note The Release upgrade files for the Cisco NAC Profiler Server and Cisco NAC Profiler Collector are available from Cisco Secure Software at http://www.cisco.com/cgi-bin/tablebuild.pl/nacprofiler-2.1.8

You must login with your Cisco registration user name and password to download the files.

•The upgrade file for the Cisco NAC Profiler Server is a single compressed format (.zip) file

•The Collector RPM is a complete package that can be used to upgrade an existing Collector service on a Clean Access Server to the latest version of the Collector. It can also be used for a "fresh" install on a CAS that does not have the Collector service running on it.

Note An MD5 checksum is posted along with each upgrade package to ensure file integrity. When clicking through the screens prior to software download, take note of the MD5 value in the Details table. Verify this against the MD5 checksum provided with the upgrade package to ensure the upgrade files are not corrupted before you start.

The Cisco NAC Profiler Server software upgrade package includes all necessary files for upgrading the Profiler Server software, underlying components, and the database. The filename of the upgrade package indicates the latest version of the Profiler Server, for example:

nac-profiler_upgrade-2.1.8-39-K9.zip

Caution Cisco highly recommends performing a database backup and moving the backup file off-appliance before you begin the upgrade process.

Note You must complete the upgrade for all Cisco NAC Profiler Servers and Collectors in the system to bring all components to the most current version.

Caution The procedures for upgrading Profiler Server are different for systems operating in HA mode. Refer to Upgrading Profiler Server HA Pairs for instructions specific to the upgrade of HA Profiler Server pairs.

Upgrading Profiler Server Standalone Systems

Upgrading the software on standalone Profiler Server systems is a straightforward process. The upgrade script automatically upgrades all installed components as needed. Follow the steps below to upgrade standalone Profiler Servers.

Step 1 Download the latest upgrade package for Cisco NAC Profiler Version 2.1.8 from Cisco Secure Software by logging into http://www.cisco.com/cgi-bin/tablebuild.pl/nacprofiler-2.1.8:

nac-profiler_upgrade-2.1.8-39-K9.zip

Note Prior to download, take note of the MD5 value in the Details table of the Software Download screens.

Step 2 SCP the upgrade package.zip file to the /home/beacon directory of the Profiler Server to be upgraded.

Step 3 Connect to the Profiler Server being upgraded via SSH. Login as user beacon with the beacon user password (default is profiler).

Step 4 Elevate to root user using the su - command and enter the password for the root user:

[beacon@profiler ~]$ su - root

Password: 

Step 5 Change directory to /home/beacon

cd /home/beacon

Step 6 Verify the MD5 checksum of the upgrade package against the checksum specified for the file on Cisco Software Download. Use the following command to generate the checksum of the file on the Profiler Server:

md5sum nac-profiler_upgrade-2.1.8-39-K9.zip

This command calculates and displays the checksum of the file to the console so that it can be checked against the one supplied with the file.

Step 7 Unzip the upgrade package:

unzip nac-profiler_upgrade-2.1.8-39-K9.zip

This command uncompresses the files required for upgrade, and creates a new subdirectory named ProfilerUpgrade-2.1.8-39 in the /home/beacon/ directory.

Step 8 Change directory to the ProfilerUpgrade directory created when the upgrade package was unzipped:

cd ProfilerUpgrade-2.1.8-39

Step 9 The directory should include a script named upgrade.pl. Execute the upgrade script by entering the following command:

./upgrade.pl

Step 10 During the upgrade process, several messages may be sent to the console indicating progress as installed components are upgraded. When the update script completes successfully, the Profiler service(s) running on the system restart at the following message, followed by the return of the system prompt:

To modify the configuration of the Profiler, use 'service profiler config'

Step 11 Verify the successful upgrade of the system by entering the 'service profiler status' command:

service profiler status

The output includes the current version of the Profiler Server, and should indicate Running status for the Server module on the system.

[root@profiler ~]# service profiler status

Profiler Status

   Version: Profiler-2.1.8-39

  o Server      Running

  o Forwarder   Not Installed

  o NetMap      Not Installed

  o NetTrap     Not Installed

  o NetWatch    Not Installed

  o NetInquiry  Not Installed

  o NetRelay    Not Installed

Upgrading Profiler Server HA Pairs

When upgrading the software on a HA Profiler Server pair, you must upgrade the Secondary appliance in the pair first, then perform upgrade on the Primary appliance. In the process of the upgrade, the system that was the Secondary prior to the upgrade will take over the functions of the Primary, similar to what would occur in the event of the failure of the Primary.

Caution Upgrading the Profiler software on a HA pair should be completed on both members of the pair sequentially in a single operation. Do not leave the pair with the first appliance upgraded and delay the upgrade of the other member of the pair.

Note If it is desirable to return the HA pair back to its state previous to the upgrade, failover of the pair will be necessary to force the member that was Primary prior to the upgrade back to that state.

Use the following procedures to upgrade the Cisco NAC Profiler Server software on the HA-Profiler pair.

Step 1 Download the latest upgrade package for Cisco NAC Profiler Version 2.1.8 by logging into Cisco Secure Software at http://www.cisco.com/cgi-bin/tablebuild.pl/nacprofiler-2.1.8:

nac-profiler_upgrade-2.1.8-39-K9.zip

Note Prior to download, take note of the MD5 value in the Details table of the Software Download screens.

Step 2 SCP the upgrade package.zip file to the /home/beacon directory of each Profiler Server in the HA pair to be upgraded. (Use the eth0 interface IP address for each appliance in the pair. Do not use the VIP.)

Step 3 Determine which appliance is currently the Secondary appliance in the pair.

Step 4 SSH to the IP address of the eth0 interface on the Secondary system being upgraded, and elevate to root user using the su - command.

Step 5 Change directory to /home/beacon (cd /home/beacon), and verify the MD5 checksum of the upgrade package against the checksum specified for the file on Cisco Software Download.Use the following command to generate the checksum of the file on the target system:

md5sum nac-profiler_upgrade-2.1.8-39-K9.zip

This command will calculate and display the checksum of the file to the console so it can be checked against the one supplied with the file.

Step 6 Unzip the upgrade package (unzip nac-profiler_upgrade-2.1.8-39-K9.zip). This will uncompress the files required for upgrade, and create a new subdirectory in named ProfilerUpgrade-2.1.8-39 in the beacon/home directory.

Step 7 Change directory to the ProfilerUpgrade-2.1.8-39 directory created when the upgrade package was unzipped.

Step 8 The directory should include a script named upgrade.pl. Execute the upgrade script by entering the following command:

./upgrade.pl

Step 9 During the upgrade process, several messages may be sent to the Console indicating progress of the upgrade as installed components are upgraded. When the update script completes successfully, the Profiler service(s) running on the system will be restarted at the following message displayed:

To modify the configuration of the Profiler, user 'service profiler config'

Followed by the return of the system prompt.

Step 10 Verify the successful upgrade of the system by entering the 'service profiler status' command. The output will include the current version of the Profiler system, and should indicate the Running status for the installed module(s) on the system.

Step 11 This completes the upgrade of the software on the original Secondary appliance.

Proceed with performing the upgrade process on the appliance that was Primary at the outset of the upgrade procedure by following the steps above. The original Primary should now be the Secondary after the failover initiated by the upgrade script completing on the original Secondary.

Once the second appliance has been successfully upgraded, both members of the HA pair are now at the new revision. To restore the pair to the state prior to the upgrade, making the original Primary the Primary for the pair again, failover the system manually using the HA Failover Procedure (if desired).

HA Failover Procedure

When performing the failover procedure, either after the initial configuration of an HA pair, or after an induced failover within the HA pair, you must allow enough time for the database synchronization to complete fully before failing the system over again.

Note The time required for database synchronization depends on the database size. In most cases, Cisco recommends allowing 15-30 minutes to elapse after initial HA configuration or a forced failover before failing the system over again.

Caution Repeatedly forcing an HA pair to fail over without providing ample time for the system to stabilize will result in undesirable behavior and may require removing and re-configuring the HA protocol in order to return the HA subsystem to stable operation.

Follow the procedure below to force the failover of an HA pair:

Step 1 SSH to the eth0 interface of the current Primary appliance in the HA pair that is to be failed over as user beacon. The SSH session should be to the eth0 interface IP and not the VIP so that the session will remain active through the failover.

Step 2 Change directory to /usr/beacon/sql, and run ./chk_status_master.sh to verify that the system you are currently on is Primary (script returns "is master").

Step 3 Switch user to root via su -

Step 4 SSH to the eth0 interface of the other appliance in the pair, the current Secondary which will become Primary upon the failover.

Step 5 Change directory to /usr/beacon/sql, and run ./chk_status_master.sh to verify that the system is in fact currently the Secondary (script returns "is slave").

Step 6 When ready to failover the pair, return to the SSH session on the current Primary, then enter the following command to temporarily stop the heartbeat from the Primary to the Secondary which will induce the desired failover:

service heartbeat stop

Step 7 Wait several seconds then return to the SSH session to the former Secondary, which now should be the current Primary. Verify that is the case by running ./chk_status_master.sh to verify that the system is now the Primary (script returns "is master").

Step 8 On the former Primary which now should be the Secondary, run the following command as root to start the heartbeat again:

service heartbeat start 

Step 9 Exit back to the beacon user then run ./chk_status_master.sh to verify that the system is currently the Secondary (script returns "is slave"). This indicates that the system successfully failed over.

At this juncture the system should now be operating in HA mode after the swap of the Primary duties.

Upgrading Collector Service on CAS

Upgrading the Collector service on a Clean Access Server NAC Appliance is accomplished via a single RPM file. The Collector RPM is a complete package that can be used to upgrade an existing Collector service on a Clean Access Server to the latest 2.1.8 version. It can also be used for a "fresh" install on a CAS that does not have the Collector service running on it. Use the following steps to upgrade the Collector.

Step 1 Download the latest Collector RPM file (e.g. nac-collector-2.1.8-39-K9.rpm) from the Cisco NAC Profiler Version 2.1.8 location on Cisco Secure Software http://www.cisco.com/cgi-bin/tablebuild.pl/nacprofiler-2.1.8.

Note Prior to download, take note of the MD5 value in the Details table of the Software Download screens.

Step 2 SCP the file to the /home/beacon directory of the CAS/Collector(s) to be upgraded.

Note If the CAS/Collector is implemented as an HA pair, copy the upgrade file to each CAS appliance using the eth0 IP address of each CAS. Do not use the Service IP address of the HA-CAS pair.

Step 3 Initiate an SSH session to the Clean Access Server being upgraded and login as the root user with the root password.

Step 4 Run the following command to verify the MD5 checksum of the upgrade file against the one provided on the Cisco Software Download site:

md5sum nac-collector-2.1.8-39-K9.rpm

Step 5 Run the RPM file by issuing the following command:

rpm -Uhv nac-collector-2.1.8-39-K9.rpm

Step 6 The RPM will complete and the command prompt will return when completed successfully.

Step 7 Issue the following command to restart the Collector service on the CAS.

service collector start

Step 8 Issue the `service collector status' command to verify the version and check the status of the Collector service.

[root@bcas1 beacon]# service collector status

Profiler Status

   Version: Collector-2.1.8-39

  o Server      Not Installed

  o Forwarder   Running

  o NetMap      Running

  o NetTrap     Running

  o NetWatch    Running

  o NetInquiry  Running

  o NetRelay    Running

[root@bcas1 beacon]#

Documentation Updates

Related Documentation

For the latest updates to Cisco NAC Profiler and Cisco NAC Appliance documentation on Cisco.com see: http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html

or simply http://www.cisco.com/go/nac/appliance

•Cisco NAC Profiler Installation and Configuration Guide, Release 2.1.8

•Release Notes for Cisco NAC Profiler, Release 2.1.8 (this document)

•Release Notes for Cisco NAC Appliance

•Cisco NAC Appliance - Clean Access Server Installation and Configuration Guide

•Cisco NAC Appliance - Clean Access Manager Installation and Configuration Guide

•Cisco NAC Appliance Service Contract / Licensing Support

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.

This document is to be used in conjunction with the documents listed in the Related Documentation section.

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2009 Cisco Systems, Inc. All rights reserved.