Your cart is empty. View / Checkout
United States Cisco SMARTnet Pricing
Other Solutions

CANAC Wokingham

Implementing NAC Appliance (Cisco Clean Access)

  • Course Availability
Price :
Course Overview :

Cisco Network Admission Control Specialist CANAC 642-591

Implementing NAC Appliance (Cisco Clean Access) v2.1

Course Code: CANAC 642-591
Version: 2.1
Duration: 3 Days

Course Overview

The Implementing NAC Appliance (Cisco Clean Access) (CANAC) training course has been designed to teach candidates how to design and implement a Cisco NAC Appliance solution to suit your network. You will learn basic configuration tasks such as NAM and NAS deployment modes, authentication (including Windows SSO), role-based access control, posture assessment and remediation.

Target Audience

Candidates who should consider attending the CANAC 642-591 Cisco training course includes anyone responsible for the design, implementation or support of a Cisco NAC Appliance installation as well as Cisco Channel Partners preparing for CCSP and NAC Specialist certification.

Course Objectives

On successfully completing the CANAC 642-591 course you will be able to:
  • Given client network security requirements, describe how a NAC Appliance (Cisco Clean Access) deployment scenario will meet or exceed network security requirements
  • Configure the common elements of a NAC Appliance (Cisco Clean Access) solution
  • Configure the NAC Appliance (Cisco Clean Access) in-band and out-of-band implementation options
  • Implement a highly available NAC Appliance (Cisco Clean Access) solution to mitigate network threats and facilitate network access for those users that meet corporate security requirements
  • Maintain a highly available NAC Appliance (Cisco Clean Access) deployment in medium and enterprise network environments

Course Prerequisites

Candidates attending the CANAC 642-591 Cisco training course should have a fundamental knowledge of implementing network security or CCSP or Cisco Security CSQ, SNRS or working knowledge of digital certificates and BCSI or working knowledge of HSRP.

Testing and Certification

The CANAC Cisco training course is the recommended preparation for the 642-591 CANAC exam required to achieve the Cisco Network Admission Control Specialist certification.

Course Content

Cisco Self-Defending Networks:
  • The Changing Landscape of Security
  • The Cisco Host-Protection Strategy
  • The Cisco SDN Initiative
  • Trust & Identity
  • Cisco NAC Products
Cisco NAC Appliance:
  • Cisco NAC Appliance Solution
  • Cisco NAC Appliance Features
  • Cisco NAC Appliance Components
  • Compliance Scenarios
  • Deployment Options
  • Configuration Overview
  • User Interface
Cisco NAC Appliance Deployment Options:
  • Cisco NAC Appliance Out-of-Band (OOB) Deployment
  • Cisco NAC Appliance In-Band Deployment
  • Compare Cisco NAC Appliance Deployment Options
  • Cisco NAS Operating Modes
  • Virtual Gateway vs. Real-IP Gateway
  • Layer 2 vs. Layer 3
Configure User Roles:
  • Defining what is a User Role
  • Create User Roles
  • Define Traffic Policies for User Roles
  • Configure Traffic Policies for User Roles
  • Create Local User Accounts
Configure External Authentication:
  • Configure External Authentication Providers
  • Authenticate Cisco NAC Appliance Users with Kerberos
  • Authenticate Cisco NAC Appliance Users with RADIUS
  • Authenticate Cisco NAC Appliance Users with LDAP
  • Authenticate Cisco NAC Appliance Users with NT Domain
  • Map Users to User Roles
  • Test User Authentication
  • Configure RADIUS Accounting for Users
  • Adding Custom RADIUS Attributes
Configure DHCP:
  • Cisco NAS DHCP Modes
  • Enable the DHCP Module
  • Configure IP Ranges (IP Address Pools)
  • Work with Subnets
  • Reserve IP Addresses
  • Configure User-Specified DHCP Options
NAC Appliance Implementation; Implement Cisco NAC Appliance In-Band Deployment:
  • In-Band Process Flow
  • In-Band Deployment Configurations
  • Configure the Cisco NAS for In-Band Deployment
  • Add the Cisco NAS to the Managed Domain
  • Configure the Cisco NAS Interfaces
  • Add Managed Subnets andConfigure Cisco NAS VLAN Settings
Implement Windows Active Directory Single Sign-On (AD SSO):
  • Kerberos Ticket Exchange
  • Confirming a NAS Ticket
  • Communications between the NAS and Active Directory
  • AD SSO Configuration Checklist
  • TCP & UPD Ports Required for AD SSO
  • Configure the NAS for AD SSO
  • Install Support Tools for Windows 2000 or 2003 Server
  • Configure the Domain Controller with ktpass.exe
Implement Virtual Private Network Single Sign-On (VPN SSO):
  • Configuration Checklist
  • Configure a Traffic Filter
  • Add VPN Authentication Server to NAM
  • Map VPN Users to Roles on NAM
  • Enable VPN SSO on the NAS
  • Adding a VPN Device to the NAS
  • Configure RADIUS Accounting
  • Configure the VPN Gateway as a Floating Device
  • Test VPN SSO
Implement Cisco NAC Appliance Out-of-Band Deployment:
  • OOB Process Flow
  • OOB Deployment Considerations
  • Layer 2 Central & Edge Deployment
  • Layer 3 Virtual Gateway & Real-IP Gateway
  • Layer 2 & 3 Clientless Host Options
  • Differences between Cisco NAC Appliance OOB Setup and In-Band Setup
  • Implement Cisco NAS OOB Operating Modes
Manage Switches:
  • Implement Switch Management
  • Configure the Network for OOB Deployment
  • Configure Group, Switch, and Port Profiles
  • Configure Port Profiles Adding Switches to the Managed Domain
  • Configuring SNMP Advanced Settings
  • Configure Switch Ports to Use Port Profiles
  • Manage Switch Configuration Settings
NAC Appliance Implementation Options, Implement Cisco NAC Appliance on a Network:
  • Implement Cisco NAC Appliance
  • General Setup Tab
  • User Pages
  • Configure Cisco NAA Support
  • Manage Certified Devices
  • Device Exemption
  • Viewing User Reports
Implement Network Scanning:
  • Configure the Quarantine Role
  • Implement Nessus Plug-Ins
  • Test a Scanning Configuration
  • Customize the User Agreement Page
  • View Scan Reports
Configure the NAM to Implement Cisco NAC Appliance Agent on User Devices:
  • Configure the Cisco NAM to Implement the Cisco NAC Appliance Agent (NAA)
  • Retrieve Updates
  • Require the Use of the Cisco NAA
  • Configure the Cisco NAA Temporary Role
  • Introduce Checks, Rules, and Requirements
  • Create a Check, Rules, and Requirements
  • Map Requirements to Rules and Roles
Configure NAM High Availability (HA):
  • Introduce HA for Cisco NAMs
  • Establish a Serial Connection Between Managers
  • Digital Certificate Requirements
  • Configure the Primary Cisco NAM
  • Configure the Standby Cisco NAM
Configure Cisco NAC Appliance Server (NAS) HA:
  • Introduce HA for NASs
  • Implementation Considerations
  • Digital Certificate Requirements
  • Configure the Primary and Standby NAS
  • Complete the Standby NAS HA Configuration
  • Test the NAS HA Configuration
  • Configure DHCP Failover
NAC Appliance Monitoring and Administration, Monitor a Cisco NAC Appliance Deployment:
  • Cisco NAC Appliance Monitoring
  • Monitor Online Users
  • Monitor NAS Health Event Logs
  • Configure Basic SNMP Support
  • Configure Syslog Support
Administer Cisco NAM:
  • Define the Cisco NAM Administration Module
  • Set Network and Failover Parameters
  • Manage Administration Groups
  • Manage Administration Users
  • Manage User Passwords
  • Administer the System Time
  • Manage SSL Certificates
  • Manage the Cisco NAC Appliance Software
  • Protect Your NAM Configuration
PLEASE NOTE: Every effort has been made to ensure the accuracy of all information contained herein. IT Help and Support Centre Ltd makes no warranty expressed or implied with respect to accuracy of this information, including price, product editorials or product specifications. IT Help and Support Centre Ltd or its suppliers shall not be liable for incidental, consequential or special damages arising from, or as a result of, any electronic transmission or the accuracy of the information contained herin, even if IT Help and Support Centre Ltd has been advised of the possibility of such damages. Product and manufacturer names are used only for the purpose of identification.

This Website is not sponsored by, endorsed by or affiliated with Cisco Systems, Inc. CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, Cisco IOS, Cisco Systems, the Cisco Systems logo, and Networking Academy are registered trademarks or trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this web site are the property of their respective owners.
Privacy Statement Terms & Conditions