 Feedback
|
Table Of Contents
Release Notes for Cisco NAC Profiler, Release 3.1.0
Cisco NAC Appliance/ Cisco NAC Profiler Compatibility Matrix
Cisco NAC Profiler Collector Support and Cisco NAC Server Deployment Modes
Cisco NAC Profiler Integration with Cisco NAC Appliance Deployments
Cisco NAC Profiler Not Integrated with Cisco NAC Appliance
Determining the Software Version
Cisco NAC Profiler Collector (on Cisco NAC Server)
Enhancements in Cisco NAC Profiler Release 3.1.0
Cisco NAC Profiler Server Operating System Change
Endpoint Profile Creation and Management
Endpoint Data Collection and Profiling from Active Directory
CDP Data Collection and Profiling
RADIUS Accounting Data Collection and Profiling
Redesigned Timeouts for Database Management
Net Relay Module Configuration for NetFlow
Trap Handling by the Cisco NAC Profiler System
Improved Management of Cisco NAC Profiler License Files through the UI
Scripted Support for SSL Certificate Management
Scripted Support for NTP Configuration
Advanced Search and Reporting Tool
Exporting Cisco NAC Profiler Data
Reporting of Network Devices in No Contact and or Lost Contact Status
Select View Functionality for Tables
Supported Web Browsers for Version 3.1.0
Open Caveats - Release 3.1.0-24
Resolved Caveats - Release 3.1.0-24
New Installation of Cisco NAC Profiler Release 3.1.0-24
Cisco NAC Profiler Server and Cisco NAC Profiler Lite Server
Upgrade Instructions for Release 3.1.0-24
Upgrading Cisco NAC Profiler Server HA Pairs from Version 2.1.8 to 3.1.0
Installing New/Upgrading Cisco NAC Profiler Collector Service on Cisco NAC Server
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco NAC Profiler, Release 3.1.0
Revised: March 2, 2010, OL-20644-01Contents
These release notes provide late-breaking and release information for Cisco NAC Profiler, release 3.1.0. This document describes new features, changes to existing features, limitations and restrictions ("caveats"), upgrade instructions, and related information. These release notes supplement the Cisco NAC Profiler and Cisco NAC Appliance documentation included with the distribution. Read these release notes carefully and refer to the upgrade instructions prior to installing the software.
•
Open Caveats - Release 3.1.0-24
•
•
Cisco NAC Profiler Releases
Note
System Requirements
This section contains the following:
Licensing
For general information on licensing for Cisco NAC Profiler Server and Cisco NAC Profiler Collector see Cisco NAC Appliance Service Contract / Licensing Support.
Hardware Supported
The Cisco NAC Profiler system consists of a Cisco NAC Profiler Server or Cisco NAC Profiler Lite Server, implemented as a standalone appliance or High Availability (HA) pair, and one or more Profiler Collectors that run on NAC Server appliances (NAC-3310 or NAC-3350). The Profiler Collectors can also be deployed as HA pairs when run on NAC Server HA pairs.
The Cisco NAC Profiler appliances leverage the Cisco NAC Appliance 3300 Series hardware platforms.
Cisco NAC Profiler Server
The Cisco NAC Profiler Server is based on the NAC-3350 hardware platform and is pre-installed with a default version of the Cisco NAC Profiler Server software.
Cisco NAC Profiler Lite
The Cisco NAC Profiler Lite is based on the NAC-3310 hardware platform and is also pre-installed with a default version of the Cisco NAC Profiler Lite software. Profiler Lite requires a separate ISO file.
Cisco NAC Profiler Collector (on Cisco NAC Server)
A default version of the Profiler Collector component is included as service on NAC Server appliances beginning with the Cisco NAC Appliance release 4.1.2.1 and later. The NAC Server operates on NAC-3310 and/or NAC-3350 SERVER Appliance platforms only.
Note
Note
See New and Changed Information for details on the latest release 3.1.0 builds.
For ordering information, refer to the Cisco NAC Profiler Ordering Guide.
Software Compatibility
This section describes the following:
•
•
Cisco NAC Appliance/ Cisco NAC Profiler Compatibility Matrix
Table 1 shows Cisco NAC Appliance and Cisco NAC Profiler compatibility and software versions supported for each component of the Cisco NAC Profiler solution. For proper operation, both the Profiler Collector(s) and Profiler Server (Profiler Server or Profiler Lite) must run the same version of the Cisco NAC Profiler software.
Note
Note
Table 1 Cisco NAC Appliance / Cisco NAC Profiler Compatibility Matrix 1
4.7(2)
2.1.8-39
3.1.0-245
3.1.0-24
4.7(1)
2.1.8-39
4.6(1)
2.1.8-37
1 The Collector component and the Profiler Server must run the same version of the Cisco NAC Profiler software to inter-operate (e.g. 3.1.0-24).
2 Each version of the NAC Server software is shipped with a default version of the Profiler Collector component starting from Cisco NAC Appliance release 4.1.2.1 and later. The Profiler Collector can be upgraded independently of the NAC Server software for compatibility with a later Profiler Server/Profiler Lite Server release.
3 You must upgrade the Collector component on each NAC Server as described in Installing New/Upgrading Cisco NAC Profiler Collector Service on Cisco NAC Server.
4 The Profiler Lite appliance platform is supported starting from release 2.1.8-37 and later and requires a separate ISO file. Only the nac-profilerlite-3.1.0-24-K9.iso file (or later) can be installed on the Profiler Lite platform. See Hardware Supported.
5 Cisco NAC Appliance 4.7 releases are shipped with Collector version 2.1.8-39 by default. When upgrading the NAC Server to a newer Cisco NAC Appliance release, the current version of the Collector is replaced with the default version of the Collector shipped with the Cisco NAC Appliance release. For example, if you are running NAC 4.7(1) and Profiler 3.1 and you upgrade to NAC 4.7(2), you need to manually re-install the 3.1.0 Collector and configure it after the NAC Server upgrade.
Cisco NAC Profiler Collector Support and Cisco NAC Server Deployment Modes
The Cisco NAC Profiler system can be deployed in two primary modes:
1.
2.
The Collector service running on the NAC Server is composed of the following component modules: NetMap, NetTrap, NetWatch, NetInquiry, NetRelay which collect endpoint data, and the Forwarder module which provides communication between the Collector service running on a NAC Server and the Profiler Server. Depending on the deployment mode, there are additional considerations around Profiler Collector deployment which are outlined in the following sections.
Cisco NAC Profiler Integration with Cisco NAC Appliance Deployments
In this mode of Cisco NAC Profiler deployment, the NAC Server Operating mode determines considerations for the Profiler Collector running on the NAC Server. Table 2 details the features supported for each of the endpoint data collection modules based on NAC Server operating mode. A `Y' in the column for each of the operational modes indicates that the collection function is available with any caveats indicated by the note(s). `Selective' indicates that the collection function is available but subject to certain limitations that are outlined in the notes.
Table 2 NAC Profiler Collector Modules and Cisco NAC Appliance Server Operating Mode
NetMap
SNMP polling of switches and routers
Yes
Yes1
Yes
Yes 1
NetTrap
Receive SNMP traps from switches
Yes
Yes 1
Yes
Yes 1
NetWatch 2
•
•
Yes 3
Yes
Yes 3
Yes
Yes 3
Yes
Yes 3
Yes
NetInquiry
Active Profiling of endpoints
Yes
Yes1
Yes
Yes 4
NetRelay
Reception of NetFlow Export Data Records
Yes
Yes 1
Yes
Yes 1
1 The CAS/Collector in Virtual Gateway (bridged) mode can reliably contact endpoints/devices via the "untrusted" interface (eth1). However, a Virtual Gateway CAS/Collector cannot communicate with any Layer 2-adjacent device with the exception of its own default gateway via the "trusted" interface (eth0). This means the Virtual Gateway CAS cannot talk to, via its eth0 interface:
-- any host connected to a trusted-side VLAN that is declared in the VLAN mapping table
-- any host connected to a configured trusted-side CAS management VLAN
-- any host connected to the trusted-side native VLAN (i.e. non-tagged traffic being bridged by the Virtual Gateway CAS)
As long as the trusted-side target device is not Layer 2-adjacent, then the CAS can communicate with the device reliably via the eth0 interface. The target device must be separated from the CAS on trusted side by one or more Layer3 routing hops.
The use of dedicated management VLANs for switches and routers (but not the same VLAN as the CAS management VLAN) is a general network engineering best practice that removes this concern for the purposes of both NetMap and NetRelay Collector component modules (and also NetInquiry, for Virtual Gateway In-Band only. For NetInquiry with Virtual Gateway OOB, see [4]).2 The NetWatch Collector component module is used to observe endpoint behavior through targeted analysis of network traffic "sniffed" from various sources via any available network interface on the CAS/Collector. However NAC Profiler Collector functionality must coexist with CAS functionality. Therefore, not all of the CAS Ethernet interfaces can be used for general purpose monitoring (as detailed in the following notes). NetWatch is typically used:
-- To sniff endpoint traffic via a switch-based port or VLAN monitoring mechanism ("SPAN" or similar), with network traffic directed to the eth3 interface (and/or eth2, for a standalone CAS - see [3]).3 When the CAS is deployed as a High Availability (HA) pair, eth2 is typically used for the UDP HA heartbeat connection. When eth2 is used for HA, eth2 is not available for NetWatch. For this reason, Cisco recommends using the eth3 interface of the CAS for general purpose traffic monitoring in most cases.
4 For Virtual Gateway OOB deployments, NetInquiry on the NAC Profiler Collector can actively profile endpoints while they are in the untrusted state. When an endpoint becomes OOB connected to an access VLAN, NetInquiry is NOT able to actively profile this endpoint while it remains in this state IF (and only if) the access VLAN is in the CAS VLAN Mapping Table (see [1]). If the endpoint becomes OOB connected via an access VLAN that is not in the VLAN Mapping Table (such that the endpoint is no longer Layer 2 adjacent to the CAS) then NetInquiry can continue actively profiling this endpoint.
Cisco NAC Profiler Not Integrated with Cisco NAC Appliance
In this deployment mode, although the Cisco NAC Appliance-specific NAC Server services are not utilized, the Profiler Collector utilizes the operating system and underlying configuration of the NAC Server in order to perform the endpoint data collection process.
You will need to perform minimum configuration of the NAC Server, as described in the "Perform the Initial CAS Configuration" section of the Cisco NAC Appliance Hardware Installation Guide, Release 4.7. See also "Startup of NAC Profiler Collectors" in the Cisco NAC Profiler Installation and Configuration Guide, Release 3.1
Note
Determining the Software Version
You can determine the full version of Cisco NAC Profiler components as follows:
•
Cisco NAC Profiler Server
Via the UI
•
Via SSH
•
[root@profiler ~]# service profiler statusProfiler StatusVersion: Profiler-3.1.0-24o Server Runningo Forwarder Not Installedo NetMap Not Installedo NetTrap Not Installedo NetWatch Not Installedo NetInquiry Not Installedo NetRelay Not InstalledCisco NAC Profiler Collector (on Cisco NAC Server)
•
[root@bcas1 beacon]# service collector statusProfiler StatusVersion: Collector-3.1.0-24o Server Not Installedo Forwarder Runningo NetMap Runningo NetTrap Runningo NetWatch Runningo NetInquiry Runningo NetRelay RunningNew and Changed Information
This section describes enhancements added to the following releases of Cisco NAC Profiler:
•
Enhancements in Cisco NAC Profiler Release 3.1.0
Cisco NAC Profiler release 3.1.0 is a new feature release that contains significant enhancements to functionality from earlier versions as many new features and functionalities. Release 3.1.0 is available as an ISO only for the Profiler Server and Profiler Lite due to a change in the operating system. There is no upgrade file for Release 3.1.0.
The upgrade procedure for Profiler Server and Profiler Lite systems running version 2.1.8 or earlier to release 3.1.0 involves running a utility to migrate the existing database, including all Cisco NAC Profiler configuration and data, from the system running the earlier version to the system upgraded to version 3.1.0. Refer to Upgrade Instructions for Release 3.1.0-24 for detailed instructions on upgrading the Profiler Server and Profiler Server Lite running version 2.1.8.
The installation/upgrade of the Profiler Collector service on the NAC Server to version 3.1.0 is performed using the RPM update process as it was in earlier versions. The Collector service uses the operating system installed on the NAC Server and the configuration created during setup of those services. Installation/Upgrade of the Collector service is provided in Installing New/Upgrading Cisco NAC Profiler Collector Service on Cisco NAC Server.
New features and enhancements in version 3.1.0 of the Cisco NAC Profiler are detailed in the following sections:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Refer to the following sections for additional details regarding this release of Cisco NAC Profiler:
•
•
•
•
Cisco NAC Profiler Server Operating System Change
The underlying operating system of the Cisco NAC Profiler Server/Cisco NAC Profiler Lite Server system has been changed from Fedora Core® to FreeBSD® in order to achieve performance enhancements and release stability for future versions.
User Interface Redesign
The Cisco NAC Profiler user interface has been completely redesigned to improve both navigation and presentation of system data and configuration. The 3.1.0 UI includes a new system dashboard providing at-a-glance system status indications and one-click navigation to the most frequently used areas of the interface.
As an option, Cisco NAC Profiler UI user authentication can now be performed via RADIUS to an external authentication service such as Cisco Secure ACS.
The admin UI user and other user accounts of type Operator are automatically logged out of the interface after 30 minutes of inactivity.
Endpoint Profile Creation and Management
Endpoint Profile creation/management in the UI has been significantly enhanced. The addition of a Certainty Calculator to the Edit Profile view eases determination of certainty value with any and all combinations of rule matches in multi-rule profiles.
The ability to group Endpoint Profiles containing endpoints with similar attributes (e.g., all printers or IP phones) was also added in this version. Endpoint Profiles can now be viewed by status (e.g., enabled, disabled, automatic) or by Profile Group.
Advanced XML Rule Editor
An Advanced XML Rule Editor was added in this version which provides the Cisco NAC Profiler Administrator assistance with the creation, editing and management of Advanced XML Rules within Endpoint Profiles. This eliminates the need to create the XML via a free-form text editor to assist with creation of Advanced rules with the correct syntax and format.
Cisco NAC Profiler Events
The Cisco NAC Profiler Events implementation, other than Cisco NAC Events, underwent a significant redesign in this version. This included a new Event Delivery method called Active Response, which can take the following actions on the switch port that connects endpoints which trigger events: Disable Port (admin down), Bounce Port, or force the 802.1X reauthentication of an endpoint on Cisco switches running compatible versions of IOS.
Note
MAC Change Events have been removed from this version. Profile Change event functionality has been expanded to two sub-types: Profile Change Entering and Profile Change Exiting. Profile Change events are now configured globally and do not require configuration on the switch and port level. Two new events types were added in this version: Alarm Profile and Profile Consistency.
See Chapter 12 - Integration with Cisco NAC Appliance of the Cisco NAC Profiler Installation and Configuration Guide, Release 3.1 for details on the Cisco NAC Profiler Events functionality.
Endpoint Data Collection and Profiling from Active Directory
Cisco NAC Profiler is now able to communicate with Microsoft Active Directory Servers for the purpose of collecting identity attributes for endpoints that are members of the Domain. Information collected for endpoints using this method can subsequently be used within Endpoint Profiles to profile endpoints based on their AD information. AD Membership, AD Computer Name, AD Information (OS, OS Version, OS Service Pack) profile rule types were added in this version.
CDP Data Collection and Profiling
Information collected by switches via the Cisco Discovery Protocol about endpoints connected to ports is now collected and made available for Endpoint Profiling. In previous versions, CDP information was used only for identification of links that interconnected switches with other switches or routers (Trunk Ports). Endpoints such as IP Phones, Virtual Gateways, etc. also use CDP to signal their presence to the switch connecting them to the network. Cisco NAC Profiler collects this information, which can be used to profile endpoints, via the CDP Platform Type rule added in this version.
RADIUS Accounting Data Collection and Profiling
RADIUS clients (switches) can be configured to forward RADIUS accounting data to Cisco NAC Profiler for the collection of endpoint data. Attributes such as RADIUS username can be used to profile endpoints using the RADIUS Username rule type added in this version.
Basic Endpoint Search
Basic Endpoint Search can now be initiated from any page of the UI at any time with search results presented in a secondary window to maintain the primary UI page. This prevents having to navigate away from the current page when searching/viewing results of basic endpoint searches. The Basic Endpoint Search queries the database for endpoint matches based on a single search criteria from the following list of endpoint identity attributes:
•
•
•
•
•
•
•
•
Redesigned Timeouts for Database Management
The Endpoint timeout scheme has been redesigned to provide more flexibility in the treatment of endpoints that are discovered and subsequently leave the network. See Chapter 6- Cisco NAC Profiler Server Configuration of the Cisco NAC Profiler Installation and Configuration Guide, Release 3.1 for complete details on the database maintenance/timeout implementation in this and future versions.
MyNetworks Configuration
Networks in the MyNetwork configuration can now be specified to have one or more excluded network/subnets, which avoids collection of IP-learned attributes of endpoints on specified nets/subnets. This feature can be used to eliminate collection of endpoint data via IP-based learning for endpoints in sections of the network where it is not desirable to perform Profiling and Identity Monitoring.
Net Relay Module Configuration for NetFlow
NetRelay is now aware of the MyNetwork configuration: NetFlow processing is now enabled per NetRelay module by specifying a Network (Organization) Name in the Profiler Collector configuration. Network (Organization) Names are configured within MyNetwork and when configuring NetRelay modules on the system, the Organization (Network) Name bounds collection of endpoint traffic data from NetFlow to only source IPs within the range specified by the Organization (Network) Name. Specifying Network Blocks in the NetRelay module configuration is no longer required.
DNS Name Collection
DNS Name collection has been enhanced to utilize Zone Transfer (AXFR), resulting in significant performance enhancement in environments using DNS name collection/DNS rules for endpoint profiling.
Trap Handling by the Cisco NAC Profiler System
Community String validation for NetTrap has been added. If a community string is configured in the NetTrap module, NetTrap only processes traps received by the Profiler Collector that have a matching community string.
Cisco MAC Notification Trap trust was added in this version and enabled by default. When the Cisco NAC Profiler system (NetTrap module on a Profiler Collector) receives a Cisco MAC Notification trap indicating that an endpoint has connected to a port, the information about the endpoint within the trap is used by the Profiler system avoiding an SNMP query to the switch to verify the information.
To reduce the time required for the Profiler system to discover endpoints connected to switches that do not support Cisco MAC notification traps, an option has been added to the Network Device and Network Device Group configuration that disables the default behavior of the Cisco NAC Profiler to wait after receipt of a Link Up trap for a MAC notification trap which can reduce SNMP polling by Cisco NAC Profiler as described above. For switches that do not support MAC Notification traps, turning this option on allows the Profiler to complete the SNMP poll of the device immediately upon receipt of Link Up, reducing the time required for endpoint discovery on switches that do not support Cisco MAC notification traps.
Improved Management of Cisco NAC Profiler License Files through the UI
The display and management of Cisco NAC Profiler license files has been completely re-designed in this version. The UI now displays the license files uploaded to the system along with their type (such as, Server or Collector components) and a clear indication of the validity of the license file providing at-a-glance determination of the license status of the Cisco NAC Profiler System from a single page in the UI.
Scripted Support for SSL Certificate Management
Support for SSL certificates has been enhanced and automated through the Profiler Server Only system type startup scripts, and the 'service profiler' command set. A menu-driven script is utilized for creation of self-signed certificates and the ability to generate/download a CSR for submission to a CA.
Scripted Support for NTP Configuration
The Profiler Server startup scripts include automated setup of NTP when configuring the system initially, and can be called via the `service profiler' command to manage NTP configuration. Use of NTP is recommended for all Profiler Server systems and mandatory for HA systems beginning with this version.
Advanced Search and Reporting Tool
An Advanced Search and reporting tool has been added to the system that significantly enhances the utility of the endpoint search function. The advanced search allows searching using multiple attributes (logical 'and' only), and supports 'not' and 'or' logical operations on any single attribute. Searches can be revised through multiple iterations to refine results, and search results may be exported from the UI directly in CSV and XML formats.
Exporting Cisco NAC Profiler Data
Exporting of Cisco NAC Profiler data from the Profiler Server has been greatly enhanced. Reporting via download in CSV and XML formats from the UI directly to the management PC has been added in most of the commonly-used views in the Endpoint Console as well as search.
Reporting of Network Devices in No Contact and or Lost Contact Status
The Cisco NAC Profiler UI tracks the status of Network Devices (switches and routers) that are being polled by NetMap. Devices that are unable to be contacted (No Contact) and or devices that have not been successfully polled for more than two regular polls by NetMap are displayed on the Device Connectivity pie chart displayed by default on the Configuration Tab.
Select View Functionality for Tables
Select View functionality improves UI performance by limiting tables that are likely to grow very large to display only the first 100 rows by default. The user can change these views to display these tables at 100, 250, 500, 1000 rows per page or show all via the Select View control.
Supported Web Browsers for Version 3.1.0
The Cisco NAC Profiler Version 3.1.0 User Interface has been tested thoroughly with Windows® Internet Explorer® Versions 7 and 8, and Firefox® 3.0.x and later.
Note
Caveats
This section describes the following caveats.
•
•
Note
http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
Open Caveats - Release 3.1.0-24
Note
Table 3 List of Open Caveats (Sheet 1 of 4)
CSCsr58170
No
CAS service collector status should not list Server module status
CAS service collector status lists Server status as "not installed"
Conditions
Workaround
Note
CSCsr91618
No
Service profiler status lists services not supported on Profiler server
The Profiler status shows all the modules for the Collector that it will never be running or have installed.
Conditions
[root@profiler1 ~]# service profiler statusProfiler StatusVersion: Profiler-2.1.8-37o Server Runningo Forwarder Not Installedo NetMap Not Installedo NetTrap Not Installedo NetWatch Not Installedo NetInquiry Not Installedo NetRelay Not InstalledWorkaround
Note
CSCsu46348
No
Cisco NAC Profiler GUI NAC roles should use API call to populate listing
NAC Roles need to be populated with a query instead of typing them in manually in the Profiler server config—too much chance of error for user input and will increase customer ease of use.
Conditions
Workaround
CSCsw97514
No
Unable to delete a Collector from the Cisco NAC Profiler. An error pops up that Collector does not exist in the database.
Conditions
Workaround
1. SSH to the Profiler Server as user 'beacon'.
2. Enter the following command at the prompt: echo "delete from beacon_component where name LIKE '<collector name as it appears in the GUI>';" | psql
CSCsy37604
No
Cisco NAC Profiler System does not indicate the version of the Collector service running on each Collector.
Conditions
Workaround
CSCtc34810
Yes
Endpoint location data is not displayed when trunk port info is received.
Conditions
Workaround
CSCtd69946
Yes
In the CAM Device Filter list (integrated to Cisco NAC Profiler), upon clicking on the Profiler link in the Description field, the user cannot login to the profiler to view the summary information for the endpoint.
Conditions
Workaround
CSCte41353
Yes
SNMP Session Reauthentication is not working.
Conditions
Workaround
There are two components to this patch:
1.
2.
Below are the steps for both:
Steps to run script on Cisco NAC Profiler Appliance:
1. SCP ReAuth.tgz to NAC Profiler Server, /home/beacon
2. As root system user, run the following commands:
tar xvfz ReAuth.tgzcd ReAuth/bin/sh reauth.sh3. Check Server binary MD5 Sum:
md5 ServerMD5 (Server) = bb125ccb349c9b825146ed97bb3419b0Steps to run on Cisco NAC Profiler Collector Appliance (NAC Server):
1. SCP NetMap.reauth to Collector/CAS appliance.
2. As root system user, run the following commands:
service collector stopcd /usr/beacon/binmv NetMap NetMap.oldmv NetMap.reauth to /usr/beacon/bin/NetMap3. Verify checksum:
md5sum NetMap20dfa277448368a747f895164fc37e28 NetWatchCSCte60976
Yes
Trap Handling for v2c traps are INOP for version 4.7.1 of the CAS/Collector Only. Older versions of SNMP Research in the CentOS build used for Cisco NAC Appliance Release 4.7.1 result in NetTrap being unable to determine the IP address of the trapping agent.
Conditions
Workaround
As the root system user:
1. SCP the patched NetTrap binary (in .gz) format to the /usr/beacon
directory of the NAC Server/Collector
2. Stop the Collector service using 'service collector stop'
3. Unzip the patched NetTrap binary in the /usr/beacon directory:
gunzip NetTrap.gz4. Verify the checksum of the modified NetTrap:
md5sum NetTrap; checksum= 817b5a8a157b937dd996e8751f1f39095. Rename current NetTrap binary to NetTrap.old:
mv bin/NetTrapNetTrap.old6. Move patched NetTrap to bin:
mv NetTrap bin/NetTrap7. Change ownership to root:beacon :
chown root:beacon NetTrap8. Change execution privileges:
chmod 4750 NetTrap9. Restart Collector:
service collector startCSCte93435
Yes
Profiler MAC Address OU DB is outdated for HP MAC address.
Conditions
Workaround
Open Caveats - Documentation
Resolved Caveats - Release 3.1.0-24
New Installation of Cisco NAC Profiler Release 3.1.0-24
Cisco NAC Profiler Server and Cisco NAC Profiler Lite Server
If performing a new CD installation/upgrade of the Cisco NAC Profiler software on the Cisco NAC Profiler Server or Cisco NAC Profiler Lite Server or HA pair that has yet to be configured/deployed, use the steps described below.
For upgrade of an operational Cisco NAC Profiler system running version 2.1.8, refer to the instructions in Upgrade Instructions for Release 3.1.0-24 in order to retain all system configuration and data.
Note
Step 1
Step 2
•
•
Step 3
Step 4
Step 5
Step 6
Step 7
Upgrade Instructions for Release 3.1.0-24
This section provides instructions for the upgrade of operational Cisco NAC Profiler systems running all earlier versions, to version 3.1.0-24.
Note
Note
The upgrade instructions for the Profiler Server include both standalone and HA-pair configurations.
•
•
Overview
The Cisco NAC Profiler Release 3.1.0 installation files are available from Cisco Secure Software at http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=268438162.
The following files are available:
•
•
•
•
You must login with your Cisco.com registration user name and password to download the files.
Note
•
•
Caution
Note
Upgrading 2.1.8 Cisco NAC Profiler Server and Cisco NAC Profiler Lite Server Standalone Systems to 3.1.0
As outlined in Cisco NAC Profiler Server Operating System Change, the Operating System of the Profiler Server system has changed in version 3.1.0, requiring systems running 2.1.8 to undergo complete reinstallation of the Profiler Server software to successfully upgrade to release 3.1.0.
The upgrade process utilizes a standalone database migration script run on the system prior to upgrade that brings the 2.1.8 database forward to release 3.1.0 compatibility. After the ISO upgrade to release 3.1.0, the Profiler Configuration and endpoint data from the 2.1.8 system are restored to the 3.1.0 system.
Before beginning the upgrade procedure, complete the following preparations:
1.
Note
2.
Note
3.
4.
5.
6.
Once these preparations are completed, proceed with the upgrade of the standalone Profiler Server as outlined below.
Step 1
Step 2
Step 3
[beacon@profiler ~]$ su -Password:Step 4
cd /home/beaconStep 5
md5sum DB-utility_218to31x.tgzThis command calculates and displays the checksum of the file to the console so that it can be checked against the one supplied with the file.
Step 6
tar xvfz DB-utility_218to31x.tgzThis command uncompresses the files to the /home/beacon directory required for migration of the Profiler database containing the configuration and data of the 2.1.8 system so that it can be restored on the 3.1.0 system, including a script that performs the migration named upgrade.pl
Step 7
./upgrade.plStep 8
Attention:You are about to perform a major upgrade to this system. If this system has been customized outside of the normal product configuration please contact support BEFORE proceeding.Be sure to copy the resulting backup file from this upgrade script to a secure location as a fail safe.Please press Enter to continue (or ctrl+c to abort)Press Enter to begin the database migration on the 2.1.8 Cisco NAC Profiler System.
Step 9
Preparing for upgrade...Migrating GUI passwords to databaseBacking up current DB.The files required for the upgrade have been bundled and placed in /backup/upgrade/dbbackup-218.gz.Please copy /backup/upgrade/dbbackup-218.gz to a secure location (on a different system) and proceed with the upgrade per the instructions.** When the above file has been placed into a secure location insert the Profiler 3.1 installation CD and type "reboot" and press Enter to proceed with the next phase of upgrade process.{root@nac-profiler beacon}#Step 10
Warning
Step 11
Note
Step 12
rebootStep 13
Step 14
Tip
Step 15
Note
Step 16
Step 17
Step 18
Note
Step 19
Step 20
a.
cd /usr/beacon/scripts/maintb.
./restoreDB.pl /backup/dbbackup-218.gzStep 21
Step 22
Note
1. MAC Change Events are not supported. MAC Change Events that were configured on the 2.1.8 system are not carried forward through the upgrade to version 31.
2. Profile Change Events have been re-engineered and must be reconfigured after the upgrade to version 3.1. Any Profile Change Events that were configured on the 2.1.8 system are deleted.
3. If one or more NetRelay modules were configured for the processing of NetFlow on the 2.1.8 system, the Network Blocks section of the NetRelay module configuration is converted to an Organization (Network) name in the MyNetwork configuration via the upgrade. They are named <collector name>-nr-addrs, and the NetRelay module is reconfigured to use the Organization Name to configure the address space for NetFlow collection.
4. The time outs that control Database Maintenance functions of the Server module (e.g., endpoint timeout, port timeout, etc.) have been re-engineered in this version, and all configured values are reset to zero (no timeout). Review the information in Chapter 6- Cisco NAC Profiler Server Configuration of the Cisco NAC Profiler Installation and Configuration Guide, Release 3.1 regarding the new timeouts, and reconfigure these time out values to be consistent with the new mode of operation.
Note
Step 23
Step 24
Tip
Step 25
Step 26
Upgrading Cisco NAC Profiler Server HA Pairs from Version 2.1.8 to 3.1.0
As outlined in Cisco NAC Profiler Server Operating System Change, the Operating System of the Profiler Server system has changed in version 3.1.0, requiring systems running the 2.1.8 have a complete re-installation of the Profiler Server software to successfully upgrade to the 3.1.0 version.
The upgrade process utilizes a database migration script run on the system prior to upgrade that brings the 2.1.8 database forward to version 3.1.0 compatibility. After the upgrade ISO to version 3.1.0, the Profiler Configuration and endpoint data from the 2.1.8 system are restored to the 3.1.0 system.
Before beginning the upgrade procedure, complete the following preparations:
1.
Note
2.
Note
3.
4.
5.
6.
Once these preparations are completed, proceed with the upgrade of the standalone Profiler Server as outlined below.
Step 1
Step 2
Step 3
[beacon@profiler ~]$ su -Password:Step 4
cd /home/beaconStep 5
md5sum DB-utility_218to31x.tgzThis command calculates and displays the checksum of the file to the console so that it can be checked against the one supplied with the file.
Step 6
tar xvfz DB-utility_218to31x.tgzThis command uncompresses the files to the /home/beacon directory required for migration of the Profiler database containing the configuration and data on the 2.1.8 system so that it can be restored on the 3.1.0 system, including a script that performs the migration named upgrade.pl
Warning
Step 7
./upgrade.plStep 8
Attention:You are about to perform a major upgrade to this system. If this system has been customized outside of the normal product configuration please contact support BEFORE proceeding.Be sure to copy the resulting backup file from this upgrade script to a secure location as a fail safe.Please press Enter to continue (or ctrl+c to abort)Press Enter to begin the database migration on the 2.1.8 Cisco NAC Profiler System.
Step 9
Preparing for upgrade...Migrating GUI passwords to databaseBacking up current DB.The files required for the upgrade have been bundled and placed in /backup/upgrade/dbbackup-218.gz.Please copy /backup/upgrade/dbbackup-218.gz to a secure location (on a different system) and proceed with the upgrade per the instructions.** When the above file has been placed into a secure location insert the Profiler 3.1 installation CD and type "reboot" and press Enter to proceed with the next phase of upgrade process.{root@nac-profiler beacon}#Step 10
Warning
Timesaver
Step 11
Note
Step 12
rebootStep 13
Step 14
Tip
Step 15
Note
Step 16
Step 17
Step 18
Step 19
Step 20
a.
a.
cd /usr/beacon/scripts/maintb.
./restoreDB-HA.pl /backup/dbbackup-218.gzStep 21
Step 22
Note
1. MAC Change Events are not supported. MAC Change Events that were configured on the 2.1.8 system are not carried forward through the upgrade to version 31.
2. Profile Change Events have been re-engineered and must be reconfigured after the upgrade to version 3.1. Any Profile Change Events that were configured on the 2.1.8 system are deleted.
3. If one or more NetRelay modules were configured for the processing of NetFlow on the 2.1.8 system, the Network Blocks section of the NetRelay module configuration is converted to an Organization (Network) name in the MyNetwork configuration via the upgrade. They are named <collector name>-nr-addrs, and the NetRelay module is reconfigured to use the Organization Name to configure the address space for NetFlow collection.
4. The time outs that control Database Maintenance functions of the Server module (e.g., endpoint timeout, port timeout, etc.) have been re-engineered in this version, and all configured values are reset to zero (no timeout). Review the information in Chapter 6- Cisco NAC Profiler Server Configuration of the Cisco NAC Profiler Installation and Configuration Guide, Release 3.1 regarding the new timeouts, and reconfigure these time out values consistent with the new mode of operation.
Note
Step 23
Step 24
Tip
Step 25
Tip
Step 26
Installing New/Upgrading Cisco NAC Profiler Collector Service on Cisco NAC Server
New installation or upgrade of the Profiler Collector service on a Cisco NAC Server to version 3.1.0 is accomplished via a single RPM file. The Profiler Collector RPM is a complete package that can be used to upgrade an existing Collector service on a NAC Server to version 3.1.0. It can also be used for a "fresh" install on a NAC Server that does not have the Collector service running on it. Use the following steps to upgrade or install the Collector service on a NAC Server.
Note
Note
Step 1
Note
Step 2
Note
Step 3
Step 4
md5sum nac-collector-3.1.0-24-K9.rpmStep 5
rpm -Uhv nac-collector-3.1.0-24-K9.rpmStep 6
Step 7
When upgrading operational Profiler Collectors, complete the remaining steps in this section to restart the Collector services on the new software version using the existing configuration.
Step 8
service collector startStep 9
[root@bcas1 beacon]# service collector statusProfiler StatusVersion: Collector-3.1.0-24o Server Not Installedo Forwarder Runningo NetMap Runningo NetTrap Runningo NetWatch Runningo NetInquiry Runningo NetRelay Running[root@bcas1 beacon]#For Profiler Collectors running in HA mode on HA NAC Server pairs, Step 8 and Step 9 above should be performed on both NAC Server appliances in the pair.
Step 10
Documentation Updates
Table 6 Updates to Release Notes for Cisco NAC Profiler, Release 3.1.0
March 2, 2010
Cisco NAC Profiler Release 3.1.0-24.
Related Documentation
For the latest updates to Cisco NAC Profiler and Cisco NAC Appliance documentation on Cisco.com see: http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html
or simply http://www.cisco.com/go/nac/appliance
•
•
•
•
•
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the Related Documentation section.
CCDE, CCENT, CCSI, Cisco Eos, Cisco Explorer, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco TrustSec, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1002R)
© 2010 Cisco Systems, Inc. All rights reserved.
