This document describes the ordering guidelines for the Cisco® NAC Profiler product effective November 18, 2010.
What's New in This Guide?
This version of the guide incorporates the next-generation hardware for the Cisco NAC Appliance.
Next-Generation Appliances
Customers can use the next-generation appliances in combination with the existing appliances.
Cisco NAC Profiler Components
Cisco NAC Profiler contains two components: the Cisco NAC Profiler Server and the Cisco NAC Profiler Collector modules.
Cisco NAC Profiler provides the interface to create profiling rule sets. NAC Profiler manages, receives, and correlates information from NAC Profiler Collector, then provides external applications with access to the profiled device list. NAC Profiler Collector collects information about clientless devices and relays that information to the NAC Profiler Server.
As each Cisco NAC Profiler Collector gathers information from associated endpoints, the data from all the Collectors is combined and represented at the Profiler as a comprehensive list of information. This comprehensive list can be viewed within Cisco NAC Profiler or, in deployments with full Cisco NAC posture and remediation, through Cisco NAC Manager. Additionally, Cisco NAC Manager administrators can use the list created by NAC Profiler to provision the appropriate endpoint device type with the corresponding access privileges.
Deployment Options
There are two deployment choices for NAC Profiler Collectors:
• Deployment option 1: Deploy the Collectors on a Cisco NAC Server (to augment the existing posture and remediation service)
• Deployment option 2: Deploy as a standalone Collector (no posture or remediation service)
The Cisco NAC Profiler Server (NAC33XX-PROF-K9) enables profiling capability when installed on a Cisco NAC Appliance 3315 or 3355 system in either standalone or failover mode.
The Cisco NAC Profiler Collector (NAC33XX-CLT-K9=) enables collection capabilities on an existing NAC Server, and is used in full NAC deployments where NAC Manager and NAC Servers are providing posture and remediation.
The Cisco NAC Collector (NAC33XX-X000C-K9) enables collection capability only. It is used when customers are only interested in MAC Authentication Bypass (MAB), without posture or remediation. It can be installed on a Cisco NAC Appliance 3315 or 3355 system in standalone or failover mode.
About Failover Bundles
Cisco NAC Profiler components can be installed in standalone or failover mode on the Cisco NAC Appliance 3315 and 3355 hardware platforms.
Failover bundles are identified by an "FB" in the part number. The Cisco NAC Profiler Server or Collector failover bundle includes two discrete appliances. The failover mechanisms (link state and databases) will operate between each other, independent of the state of the Cisco NAC Server components.
In the case of the Cisco NAC Collector, a failover bundle must be selected if you have installed or are installing Cisco NAC Servers in failover or high-availability mode. In this scenario, the failover state of each NAC Server will determine the failover state of its corresponding Cisco NAC Collector.
A design will always include a Cisco NAC Profiler (with or without failover) and some number of Collectors. The Collector modules can be installed either on a NAC Server or as a standalone Collector.
Sizing the Deployment
Determining a design for the Cisco NAC Profiler is contingent on whether an existing or proposed full Cisco NAC solution is being considered. The following design rules should assist in determining what to order.
Design Rule 1
For NAC Profiler designs that will augment a full Cisco NAC solution, order one (1) Cisco NAC Profiler Collector license that matches the hardware platform of the Cisco NAC Appliance 3315 and 3355.
Table 1 lists the part numbers and descriptions of Cisco NAC Profiler Collector licenses along with their corresponding Cisco NAC Server part numbers for full NAC deployments.
Table 1. Part Numbers of Cisco NAC Profiler Collector Licenses to be Installed on NAC Servers as Part of a Full NAC Solution
Product Part Number
Product Description
Corresponding Cisco NAC Appliance (Clean Access Server) Part Numbers
NAC3315-CLT-K9=
Cisco NAC Profiler Collector License for Cisco NAC Appliance 3315
For every Cisco NAC Manager provided in the Cisco NAC design, order one (1) Cisco NAC Profiler Server. Table 2 lists the part numbers and descriptions of the Cisco NAC Profiler Servers.
Table 2. Part Numbers of Cisco NAC Profiler Servers
Product Part Number
Product Description
NAC3355-PROF-K9
Cisco NAC Profiler Server-up to 40K devices
NAC3355-PROF-FB-K9
Cisco NAC Profiler Server Failover Bundle-up to 40K devices
NAC3315-PROF-K9
Cisco NAC Profiler Server-up to 5K devices
NAC3315-PROF-FB-K9
Cisco NAC Profiler Server Failover Bundle-up to 5K devices
Design Rule 3
The Cisco NAC Profiler solution (Profiler Server/Profiler Collector) can be deployed independent of the NAC Appliance Manager and NAC Server components. Customers that do not require a full NAC solution may still have the need for clientless endpoint discovery. This is a common requirement for customers implementing 802.1x in wired environments. In these designs there will be one or more NAC Profiler Servers receiving information from some number of NAC Collectors. Table 3 lists the part numbers and descriptions of Cisco NAC Collectors.
Table 5 outlines the support part numbers for the Cisco NAC Profiler.
Table 5. Cisco NAC Profiler Support Part Numbers
Product Part Number
Support Description
For Cisco NAC Profiler, without Failover
CON-S2P-NPROFK9
SMARTnet 24X7X2 NAC3315-PROF-K9
CON-SNT-NPROFK9
SMARTnet 8X5XNBD NAC3315-PROF-K9
CON-SNTE-NPROFK9
SMARTnet 8X5X4 NAC3315-PROF-K9
CON-SNTP-NPROFK9
SMARTnet 24X7X4 NAC3315-PROF-K9
CON-SNT-N3355PK9
SMARTnet 8x5xNBD Service for NAC3355-PROF-K9
CON-SNTE-N3355PK9
SMARTnet 8x5x4 Service for NAC3355-PROF-K9
CON-SNTP-N3355PK9
SMARTnet 24x7x4 Service for NAC3355-PROF-K9
CON-S2P-N3355PK9
SMARTnet 24x7x2 Service for NAC3355-PROF-K9
CON-OS-N3355PK9
SMARTnet 8x5xNBD Onsite Service for NAC3355-PROF-K9
CON-OSE-N3355PK9
SMARTnet 8x5x4 Onsite Service for NAC3355-PROF-K9
CON-OSP-N3355PK9
SMARTnet 24x7x4 Onsite Service for NAC3355-PROF-K9
CON-PREM-N3355PK9
SMARTnet 24x7x2 Onsite Service for NAC3355-PROF-K9
For Cisco NAC Profiler, with Failover
CON-S2P-N3315PFB
SMARTnet 24X7X2 NAC3315-PROF-FB-K9
CON-SNT-N3315PFB
SMARTnet 8X5XNBD NAC3315-PROF-FB-K9
CON-SNTE-N3315PFB
SMARTnet 8X5X4 NAC3315-PROF-FB-K9
CON-SNTP-N3315PFB
SMARTnet 24X7X4 NAC3315-PROF-FB-K9
CON-SNT-NACP55F
SMARTnet 8x5xNBD Service for NAC3355-PROF-FB-K9
CON-SNTE-NACP55F
SMARTnet 8x5x4 Service for NAC3355-PROF-FB-K9
CON-SNTP-NACP55F
SMARTnet 24x7x4 Service for NAC3355-PROF-FB-K9
CON-S2P-NACP55F
SMARTnet 24x7x2 Service for NAC3355-PROF-FB-K9
CON-OS-NACP55F
SMARTnet 8x5xNBD Onsite Service for NAC3355-PROF-FB-K9
CON-OSE-NACP55F
SMARTnet 8x5x4 Onsite Service for NAC3355-PROF-FB-K9
CON-OSP-NACP55F
SMARTnet 24x7x4 Onsite Service for NAC3355-PROF-FB-K9
CON-PREM-NACP55F
SMARTnet 24x7x2 Onsite Service for NAC3355-PROF-FB-K9
Table 6 outlines the support part numbers for the Cisco NAC Profiler Collector.
Table 6. Cisco NAC Profiler Collector Support Part Numbers
Product Part Number
Support Description
For Cisco NAC Profiler Collectors on the NAC Appliance 3315, without Failover
CON-SNT-CLTK9315
SMARTnet 8x5xNBD Service for NAC3315-CLT-K9=
CON-SNTE-CLTK9315
SMARTnet 8x5x4 Service for NAC3315-CLT-K9=
CON-SNTP-CLTK9315
SMARTnet 24x7x4 Service for NAC3315-CLT-K9=
CON-S2P- CLTK9315
SMARTnet 24x7x2 Service for NAC3315-CLT-K9=
CON-OS- CLTK9315
SMARTnet 8x5xNBD Onsite Service for NAC3315-CLT-K9=
CON-OSE- CLTK9315
SMARTnet 8x5x4 Onsite Service for NAC3315-CLT-K9=
CON-OSP- CLTK9315
SMARTnet 24x7x4 Onsite Service for NAC3315-CLT-K9=
CON-PREM- CLTK9315
SMARTnet 24x7x2 Onsite Service for NAC3315-CLT-K9=
For Cisco NAC Profiler Collectors on the NAC Appliance 3315, with Failover
CON-SNT-CLTFBK93
SMARTnet 8x5xNBD Service for NAC3315-CLT-FB-K9=
CON-SNTE- CLTFBK93
SMARTnet 8x5x4 Service for NAC3315-CLT-FB-K9=
CON-SNTP- CLTFBK93
SMARTnet 24x7x4 Service for NAC3315-CLT-FB-K9=
CON-S2P- CLTFBK93
SMARTnet 24x7x2 Service for NAC3315-CLT-FB-K9=
CON-OS- CLTFBK93
SMARTnet 8x5xNBD Onsite Service for NAC3315-CLT-FB-K9=
CON-OSE- CLTFBK93
SMARTnet 8x5x4 Onsite Service for NAC3315-CLT-FB-K9=
CON-OSP- CLTFBK93
SMARTnet 24x7x4 Onsite Service for NAC3315-CLT-FB-K9=
CON-PREM- CLTFBK93
SMARTnet 24x7x2 Onsite Service for NAC3315-CLT-FB-K9=
For Cisco NAC Profiler Collectors on the NAC Appliance 3355, without Failover
CON-SNT-CLTK9355
SMARTnet 8x5xNBD Service for NAC3355-CLT-K9=
CON-SNTE-CLTK9355
SMARTnet 8x5x4 Service for NAC3355-CLT-K9=
CON-SNTP-CLTK9355
SMARTnet 24x7x4 Service for NAC3355-CLT-K9=
CON-S2P-CLTK9355
SMARTnet 24x7x2 Service for NAC3355-CLT-K9=
CON-OS-CLTK9355
SMARTnet 8x5xNBD Onsite Service for NAC3355-CLT-K9=
CON-OSE-CLTK9355
SMARTnet 8x5x4 Onsite Service for NAC3355-CLT-K9=
CON-OSP-CLTK9355
SMARTnet 24x7x4 Onsite Service for NAC3355-CLT-K9=
CON-PREM-CLTK9355
SMARTnet 24x7x2 Onsite Service for NAC3355-CLT-K9=
For Cisco NAC Profiler Collectors on the NAC Appliance 3355, with Failover
CON-SNT-NCLTFBK9
SMARTnet 8x5xNBD Service for NAC3355-CLT-FB-K9=
CON-SNTE- NCLTFBK9
SMARTnet 8x5x4 Service for NAC3355-CLT-FB-K9=
CON-SNTP- NCLTFBK9
SMARTnet 24x7x4 Service for NAC3355-CLT-FB-K9=
CON-S2P- NCLTFBK9
SMARTnet 24x7x2 Service for NAC3355-CLT-FB-K9=
CON-OS- NCLTFBK9
SMARTnet 8x5xNBD Onsite Service for NAC3355-CLT-FB-K9=
CON-OSE- NCLTFBK9
SMARTnet 8x5x4 Onsite Service for NAC3355-CLT-FB-K9=
CON-OSP- NCLTFBK9
SMARTnet 24x7x4 Onsite Service for NAC3355-CLT-FB-K9=
CON-PREM- NCLTFBK9
SMARTnet 24x7x2 Onsite Service for NAC3355-CLT-FB-K9=
For Cisco NAC Collector on the NAC Appliance 3315, without Failover
CON-S2P-1000CK9
SMARTnet 24X7X2 NAC3315-1000C-K9
CON-SNT-1000CK9
SMARTnet 8X5XNBD NAC3315-1000C-K9
CON-SNTE-1000CK9
SMARTnet 8X5X4 NAC3315-1000C-K9
CON-SNTP-1000CK9
SMARTnet 24X7X4 NAC3315-1000C-K9
For Cisco NAC Collector on the NAC Appliance 3315, with Failover
CON-S2P-1000CFBK
SMARTnet 24X7X2 NAC3315-1000CFB-K9
CON-SNT-1000CFBK
SMARTnet 8X5XNBD NAC3315-1000CFB-K9
CON-SNTE-1000CFBK
SMARTnet 8X5X4 NAC3315-1000CFB-K9
CON-SNTP-1000CFBK
SMARTnet 24X7X4 NAC3315-1000CFB-K9
For Cisco NAC Collector on the NAC Appliance 3355, without Failover
CON-S2P-3000CK9
SMARTnet 24X7X2 NAC3355-3000C-K9
CON-SNT-3000CK9
SMARTnet 8X5XNBD NAC3355-3000C-K9
CON-SNTE-3000CK9
SMARTnet 8X5X4 NAC3355-3000C-K9
CON-SNTP-3000CK9
SMARTnet 24X7X4 NAC3355-3000C-K9
CON-S2P-5000CK9
SMARTnet 24X7X2 NAC3355-5000C-K9
CON-SNT-5000CK9
SMARTnet 8X5XNBD NAC3355-5000C-K9
CON-SNTE-5000CK9
SMARTnet 8X5X4 NAC3355-5000C-K9
CON-SNTP-5000CK9
SMARTnet 24X7X4 NAC3355-5000C-K9
CON-S2P-7000CK9
SMARTnet 24X7X2 NAC3355-7000C-K9
CON-SNT-7000CK9
SMARTnet 8X5XNBD NAC3355-7000C-K9
CON-SNTE-7000CK9
SMARTnet 8X5X4 NAC3355-7000C-K9
CON-SNTP-7000CK9
SMARTnet 24X7X4 NAC3355-7000C-K9
For Cisco NAC Collector on the NAC Appliance 3355, with Failover
CON-S2P-3KCFBK9
SMARTnet 24X7X2 NAC3355-3000CFB-K9
CON-SNT-3KCFBK9
SMARTnet 8X5XNBD NAC3355-3000CFB-K9
CON-SNTE-3KCFBK9
SMARTnet 8X5X4 NAC3355-3000CFB-K9
CON-SNTP-3KCFBK9
SMARTnet 24X7X4 NAC3355-3000CFB-K9
CON-S2P-5KCFBK9
SMARTnet 24X7X2 NAC3355-5000CFB-K9
CON-SNT-55KCFBK9
SMARTnet 8X5XNBD NAC3355-5000CFB-K9
CON-SNTE-5KCFBK9
SMARTnet 8X5X4 NAC3355-5000CFB-K9
CON-SNTP-5KCFBK9
SMARTnet 24X7X4 NAC3355-5000CFB-K9
CON-S2P-N7KCFBK9
SMARTnet 24X7X2 NAC3355-7000CFB-K9
CON-SNT-7KCFBK9
SMARTnet 8X5XNBD NAC3355-7000CFB-K9
CON-SNTE-7KCFBK9
SMARTnet 8X5X4 NAC3355-7000CFB-K9
CON-SNTP-7KCFBK9
SMARTnet 24X7X4 NAC3355-7000CFB-K9
For Cisco NAC Collector Non-Failover Upgrade Licenses
CON-S2P-553000UL
SMARTnet 24X7X2 NAC3355-3000UL
CON-SNT-553000UL
SMARTnet 8X5XNBD NAC3355-3000UL
CON-SNTE-553000UL
SMARTnet 8X5X4 NAC3355-3000UL
CON-SNTP-553000UL
SMARTnet 24X7X4 NAC3355-3000UL
CON-S2P-5000UL
SMARTnet 24X7X2 NAC3355-5000UL
CON-SNT-5000UL
SMARTnet 8X5XNBD NAC3355-5000UL
CON-SNTE-5000UL
SMARTnet 8X5X4 NAC3355-5000UL
CON-SNTP-5000UL
SMARTnet 24X7X4 NAC3355-5000UL
For Cisco NAC Collector Failover Upgrade Licenses
CON-S2P-3000FBUL
SMARTnet 24X7X2 NAC3355-3000FBUL
CON-SNT-3000FBUL
SMARTnet 8X5XNBD NAC3355-3000FBUL
CON-SNTE-3000FBUL
SMARTnet 8X5X4 NAC3355-3000FBUL
CON-SNTP-3000FBUL
SMARTnet 24X7X4 NAC3355-3000FBUL
CON-S2P-5000FBUL
SMARTnet 24X7X2 NAC3355-5000FBUL
CON-SNT-5000FBUL
SMARTnet 8X5XNBD NAC3355-5000FBUL
CON-SNTE-5000FBUL
SMARTnet 8X5X4 NAC3355-5000FBUL
CON-SNTP-5000FBUL
SMARTnet 24X7X4 NAC3355-5000FBUL
Compatibility with Existing Cisco NAC Installations
If the Cisco NAC Appliance is already deployed, it is critical to verify that each NAC Server has enough Ethernet ports to accommodate the Cisco NAC Collector module requirements.
Frequently Asked Questions
Q. How does the Cisco NAC Profiler Server communicate endpoint information to the Cisco NAC Appliance Manager?
A. The Cisco NAC Profiler Server communicates endpoint information to the Cisco NAC Appliance Manager using the NAC Appliance API.
Q. How does the Cisco NAC Profiler determine the endpoints' identities?
A. The Cisco NAC Profiler uses several discovery techniques, including passive and active mechanisms such as Simple Network Management Protocol (SNMP), network traffic analysis, NetFlow data, and active profiling. Data from these discovery mechanisms is aggregated to provide a comprehensive, real-time view of all network-attached endpoints.
Q. Is the Cisco NAC Profiler inline?
A. No. Instead, the Cisco NAC Profiler Collector uses several discovery techniques, including SNMP, traffic analysis via SPAN, and NetFlow data.
Q. Can I deploy the Cisco NAC Profiler in in-band and out-of-band NAC Appliance deployments?
A. Yes. Cisco NAC Profiler works in either in-band or out-of-band NAC Appliance deployments.
Q. What is the maximum number of endpoints that the Cisco NAC Profiler can manage in a single database?
A. The number of endpoints that Cisco NAC Profiler supports is tied to the Cisco NAC Appliance deployment. Customers should order one Cisco NAC Profiler Server for each Cisco NAC Manager, and one Cisco NAC Profiler Collector license for each Cisco NAC Server they have deployed. Alternatively, in a Profiler deployment without other NAC components, the database size is listed in the ordering description.
Q. Can the Cisco NAC Profiler Collector license be deployed independent of the posture capabilities of the Cisco NAC Appliance Server? If so, how would it be ordered?
A. Both components of the Cisco NAC Profiler are intended to be used in support of Cisco NAC implementations. However, if customers want to begin with profiling only, without user posture, the Cisco NAC Profiler Collector license description details the device count support.
Q. My customer has already deployed Profiler and Collectors in their environment and now wishes to upgrade the Collectors to full NAC Servers to perform posture and remediation. How is this done?
A. There is no upgrade path for NAC Collectors to be converted to joint NAC Server/Collector deployments.
Q. Does the Cisco Profiler Collector support the NAC-NME modules?
A. No.
Q. How should I count endpoints for Profiler sizing and licensing?
A. Every MAC address discovered is counted, whether it is placed into a profile or not.
Q. Can the Profiler Server be integrated with more than one NAC Appliance Manager?
A. No. Only one NAC Profiler can be integrated with a NAC Appliance Manager and vice versa.
