现任明教教主 NAC Framework EOU 视频
现任明教教主 NAC Framework EOU 视频
给大家共享一下我的NAC Framework视频，Cisco的NAC有两种部署方式，一种是NAC Framework另一种是NAC appliances，为了应对CCIE Security V3的考试我准备了这么一个NAC Framework的视频，在此共享给大家，当然NAC也算是博大精深的东西，我也就算懂点皮毛，在大家面前献丑了。
如下是我整理的NAC Framework EOU的配置步骤：（也是我录像的步骤）
录像1.安装AAA Server
录像2.安装证书服务器
先安装IIS
后安装证书服务器
录像3.为AAA Server申请证书
录像4.安装CTA ！注意加载证书！
把服务器根证书方在CTA安装目录下的/certs里边
录像5上.配置AAA server
a.Interface Configuration---Advanced Options
*Group-Level Downloadable ACLs
*Network Device Groups
b.System configuration---Logging configuration---激活Passed Authentication
c.Network Configuration---New Network Device Group---FW
d.在NDG FW下创建AAA Clients
hostname :FW
IP Address :202.100.1.10
Shared Secret:cisco
NDG :FW
Authen Using :RADIUS(Cisco IOS/PIX 6.0)
e.创建用户:nac 密码:cisco (测试用)
f.Shared Profile Components---Network Access Filtering
*FW
g.Shared Profile Components---Downloadable IP ACLs
*Healthy NAF:FW
permit ip any any
*Quarantine NAF:FW
permit tcp any host 192.168.1.1 eq 80
*Unknown NAF:FW
permit tcp any host 1.1.1.1 eq 80
h.System Configuration---Global Authentication Setup
PEAP
勾选:Allow Posture Validation
录像5下.配置AAA server
i.Posture Validation---Posture Validation Components Setup---Internal Posture Validation Setup
ADD---Name:NAC
ID Condition Action
Posture Token Notification String
1 Cisco:PA:OS-Type contains Windows XP AND
Cisco:PA:OS-Version >= 5.1.0.0 Cisco:PA:Healthy You Are Healthy
2 Cisco:PA:OS-Type contains Windows XP AND
Cisco:PA:OS-Version < 5.1.0.0 Cisco:PA:Quarantine You Are Quarantine
3 Default Cisco:PA:Unknown You Are Unknown
j.Network Access Profiles
Add Profle
*******************************************
Profile Setup
Name:NAF
Active:勾选
------------------------
Network Access Filter:FW
------------------------
Protocols Types
*Allow any Protocol Type
*******************************************
A.Policies 1 Authentication for NAF
Authentication Protocols
Allow PAP（便于test）
------------------------
EAP Configuration
PEAP
勾选:Allow Posture Validation
------------------------
Credential Validation Databases
选择ACS Internal Database
*******************************************
B.Policies 2 Posture Validation for NAF
ADD Rule
Name:NAC
-------------------------
Action
Select internal Posture Validation Policies
勾选 NAC
-------------------------
System Posture Token Configuration
System
Posture Token PA Message URL Redirect
Healthy You are Healthy
Quarantine You are Quarantine http://192.168.1.1
Unknown You are Unknown http://1.1.1.1
*******************************************
C.Policies 3 Authorization Rules for NAF
Add Rule
User Group System Deny Shared Downloadable
Posture Access RAC
Token
Any Healthy 空 空 Healthy
Any Quarantine 空 空 Quarantine
Any Unknown 空 空 Unknown
空 空 Unknown
录像6.配置router
*******基本部分********
%%%%%%%%%%%%%%%%%%%%%FW%%%%%%%%%%%%%%%%%%%%%%%
enable
config ter
hostname FW
interface FastEthernet0/0
ip address 202.100.1.10 255.255.255.0
no shut
interface FastEthernet1/0
ip address 10.1.1.10 255.255.255.0
no shut
interface FastEthernet2/0
ip address 192.168.1.10 255.255.255.0
no shut
ip route 1.1.1.1 255.255.255.255 192.168.1.1
%%%%%%%%%%%%%%%%%%%%%IN%%%%%%%%%%%%%%%%%%%%%%%%
enable
config t
hostname IN
interface FastEthernet1/0
ip address 10.1.1.1 255.255.255.0
no shut
ip http server
ip route 0.0.0.0 0.0.0.0 10.1.1.10
line vty 0 15
privilege level 15
no login
%%%%%%%%%%%%%%%%%%%%%OUT%%%%%%%%%%%%%%%%%%%%%%%
enable
config t
hostname OUT
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
no shut
ip http server
ip route 0.0.0.0 0.0.0.0 202.100.1.10
line vty 0 15
privilege level 15
no login
%%%%%%%%%%%%%%%%%%%%%DMZ%%%%%%%%%%%%%%%%%%%%%%%
enable
config t
hostname DMZ
interface Loopback0
ip address 1.1.1.1 255.255.255.255
interface FastEthernet2/0
ip address 192.168.1.1 255.255.255.0
no shut
ip http server
ip route 0.0.0.0 0.0.0.0 192.168.1.10
line vty 0 15
privilege level 15
no login
*******NAC部分**********
enable
config t
aaa new-model
aaa authentication login noacs line none
aaa authentication eou default group radius
ip admission name NAC eapoudp
interface FastEthernet1/0
ip access-group 101 in
ip admission NAC
ip http server
ip http authentication aaa
access-list 101 permit udp any any eq 21862
radius-server host 202.100.1.100 key cisco
radius-server vsa send authentication
line con 0
login authentication noacs
line aux 0
login authentication noacs
end
wr
录像7.a.测试Healthy
b.测试Quarantine
修改
Posture Validation---Posture Validation Components Setup---Internal Posture Validation Setup
ADD---Name:NAC
ID Condition Action
Posture Token Notification String
1 Cisco:PA:OS-Type contains Windows XP AND
Cisco:PA:OS-Version >= 5.3.0.0 Cisco:PA:Healthy You Are Healthy
2 Cisco:PA:OS-Type contains Windows XP AND
Cisco:PA:OS-Version < 5.3.0.0 Cisco:PA:Quarantine You Are Quarantine
3 Default Cisco:PA:Unknown You Are Unknown
c.测试Unknown
修改
Posture Validation---Posture Validation Components Setup---Internal Posture Validation Setup
ADD---Name:NAC
ID Condition Action
Posture Token Notification String
1 Cisco:PA:OS-Type contains Windows XP AND
Cisco:PA:OS-Version >= 5.3.0.0 Cisco:PA:Healthy You Are Healthy
2 Cisco:PA:OS-Type = Windows XP AND
Cisco:PA:OS-Version < 5.3.0.0 Cisco:PA:Quarantine You Are Quarantine
3 Default Cisco:PA:Unknown You Are Unknown
录像8.测试Clientless
enable
config t
identity profile eapoudp
device authorize ip-address 10.1.1.254 policy NACless
identity policy NACless
access-group clientException
redirect url http://1.1.1.1
ip access-list extended clientException
permit ip any host 1.1.1.1
下面是共享视频下载地址：
http://www.rayfile.com/files/a23aa982-33c9-11df-a73b-0015c55db73d/