Cisco NAC Appliance (Clean Access)

This document addresses the most frequently asked questions (FAQs) related to Cisco Clean Access Server (formerly Perfigo SecureSmart Server).

The product names have changed. This table lists both the old and new names:

A. The DHCP settings are "Compiled" on the Clean Access Server. Sometimes these compiled settings can become corrupted, especially after an upgrade to the Clean Access server software. The solution is to force the Clean Access server to recompile the settings. In order to do this, make a change and then click update.

Symptoms:

The DHCP server does not start, or it occasionally fails on the Clean Access Server.

Instructions:

1. If the dhcp daemon of the server does not start, go into the manager, open up that particular server, and click on manage.

2. Select Network > DHCP > Subnet List and click on edit for one of the subnet lists.

3. Make any change to the subnet (for example, increase the lease time by 1 minute), then click update.

4. Go back to the status page and see if the DHCP service has started. At this point the DHCP settings should be re-compiled.

Note: Another situation that can cause the DHCP server not to start is overlapping subnet configurations. Check for this as well.

A. Use this as a guide to set up appropriate network interface cards in the /etc/modules.conf file.

Note: Append the options parameter at the end for the /etc/modules.conf file with the use of the vi editor.

• Set broadcom 5700 cards to 100 Mbps full duplex:

  options bcm5700 line_speed=100,100 auto_speed=0,0 duplex=1,1
  

• Set broadcom 5700 cards to 1000 Mbps full duplex:

  options bcm5700 line_speed=1000,1000 auto_speed=0,0 duplex=1,1 
  

• Set e1000 cards to 100 Mbps full duplex:

  options e1000 Speed=100,100 Duplex=2,2
  

• Set e1000 cards to 1000 Mbps full duplex:

  options e1000 Speed=1000,1000 Duplex=2,2
  

• Set eepro100 cards to 100 Mbps full duplex:

  options eepro100 option="0x30,0x30"
  

A. This is an example of the error:

Authentication  2004-08-26 12:13:48  
Unable to ping 149.151.206.251, going to logout user user1

Check to see if the device has any built-in firewalls that block ARP packets from the Cisco Clean Access Server. The Cisco Clean Access Server performs ARP ping. This is an ARP message and should not be blocked.

A. Run the mii-tool utility from the command line. It works for the on-board NIC, but does not support fiber NICs.

For fiber NICs, use the grep 'eth0' command on /var/log/messages.

You can also issue a tail -f command on /var/log/messages. This displays messages whenever a NIC becomes active or inactive.

A. The Cisco Clean Access Manager takes three minutes to timeout each Cisco Clean Access Server before it displays the Not Connected status.

A. Make sure that you configure a serial port for failover connection.

If the computer that runs the Cisco Clean Access Server software has two serial ports, you can use the additional port for the serial cable connection. By default, the first serial connector detected on the server is configured for console input/output (to facilitate installation and other types of administrative access). If the computer has only one serial port (ttyS0) and you do not intend to use it for administrative access, you can reconfigure the port to serve as the failover connection.

Complete these steps in order to reconfigure ttyS0 as the heartbeat connection:

1. From an SSH client, access the Cisco Clean Access Server as root user.
2. Edit /etc/lilo.conf and remove or comment out the last line:

   append="console=ttyS0....."

   This line causes console output to be redirected to the serial port.

   Note: Add a # character to the start of the line in order to comment out a line. Lines that start with this character are ignored.

3. Edit /etc/inittab and remove or comment out the last line:

   co:2345:respawn ...vt100

   This line causes a login terminal to start on the serial port.
4. Type lilo and press enter at the command prompt. This starts Lilo, the Linux boot loader.
5. Enter the reboot command to reboot the computer.
6. Repeat the steps on the failover peer Cisco Clean Access Server.

A. If you have a non-site license, you do not need to inform Cisco Technical Support of the change on the MAC address. You only need to inform Cisco Technical Support when your number of Clean Access Servers changes. If you have a site license, you do not need to inform Cisco Technical Support.

A. Complete these steps:

1. Save the rawrite file to C:\ and the LSI Driver. Update files in the same directory.
2. Open a command prompt and enter C:\rawrite.
3. Enter the full name of the source file(s) and the destination on to two floppy disks.
4. Insert the Clean Access Manager Machines (formerly CleanMachines) Installation CD into Cisco Clean Access Server or Cisco Clean Access Manager.
5. Enter custom at the boot> prompt.
6. Follow the instructions to enter the Update disk, and then the Driver disk.

A. Complete these steps:

1. Console into the box:

   cd /lib/modules/kernel-2.4.9-perfigo/drivers/addon/bcm5700
   
   insmod ./bcm5700.o

2. If step 1 results in no errors, enter the vi /etc/modules.conf command and add these two lines:

   alias eth0 bcm5700
   
   alias eth1 bcm5700

A. Complete these steps for each Cisco Clean Access Server deployed behind a NAT gateway.

1. SSH to the SecureSmart server or use a serial console to login as root.
2. Edit the /perfigo/access/bin/starttomcat file.
3. Append -Djava.rmi.server.hostname=<CAS_hostname> to the CATALINA_OPTS variable line.
4. Restart service perfigo restart.
5. SSH to SmartManager or use a serial console to login as root.
6. Edit the /etc/hosts file and append this line:

   <public_IP_address>  <securesmart_hostname> <securesmart_hostname> 

A. These are the heartbeat messages that you see:

heartbeat: 2004/09/15_11:23:27 info: Heartbeat restart on node ss1

heartbeat: 2004/09/15_14:19:17 info: Heartbeat restart on node ss1

heartbeat: 2004/09/15_18:59:53 info: Heartbeat restart on node ss1

heartbeat: 2004/09/15_19:36:18 info: Heartbeat restart on node ss1

You see these messages when the peer server is up after a reboot. You can also see it in the log on the primary server when:

• You issue service perfigo stop and then service perfigo start on the peer or standby machine.

  or

• Reboot a peer or standby machine.

Note:  When you issue the service perfigo restart command, it does not trigger this log.

A. Check these items:

• The shared secret is the same on the Cisco Clean Access Server and the Cisco Clean Access Manager.

• The certificates are correct.

• The connectivity between the Cisco Clean Access Server and Cisco Clean Access Manager and that there are not any firewall rules that block the RMI ports.

A. In some instances, the ss_key is no longer the same. Complete these steps.

1. SSH to the Cisco Clean Access Manager and obtain the ss_key.
2. Issue the psql -h 127.0.0.1 -U postgres controlsmartdb command.
3. Select * from securesmart_info.

   ss_key                | ss_group |     ss_type      |   ss_ip   | ss_loc
   
    00_40_33_60_43_D2_04_54_48_55_66_D5 |    | standard_gateway | 10.0.0.1 |

4. SSH to the Cisco Clean Access Server and obtain/update the ss_key.
5. Issue the [root@securesmart etc]# cat /etc/.GUSSK command.

   [root@securesmart etc]# cat /etc/.GUSSK
   
   00_30_48_80_43_D6_00_30_48_80_43_D5

6. Edit /etc/.GUSSK and update it with the ss_key from the Clean Access Manager.
7. Perform a reboot.

A. No limit is placed for IPsec.

PPTP and L2TP are currently set to 32 tunnels each.

A. Cisco recommends that you change the IP address of the Cisco Clean Access Server via the Manager UI. When the IP address of the Cisco Clean Access Server is changed from the Manager UI, reboot the Cisco Clean Access Manager. It automatically tries to connect to the Cisco Clean Access Manager upon reboot. The Cisco Clean Access Manager changes the IP address of the Cisco Clean Access Server in the database and the SSKEY remains the same.

Note: If you delete and re-add the Cisco Clean Access Server, you lose all the configuration settings of the Cisco Clean Access Server.

A. Add a line similar to this example in order to change the /etc/ssh/sshd_config file:

ListenAddress IP_address_of_where_you_want_ssh_to_allow_connections

For example:

ListenAddress 192.168.151.60 

Issue the service sshd restart command in order to restart the SSHD process.

A. Under CleanMachines, uncheck Windows All and select each OS independently for Require Use of SmartEnforcer or not.

A. The limit of 1000 is a warning only. If the machine has enough memory (more than 1G), you can configure up to 2500 subnets.

A. Add the MAC addresses of the Access Points to the Filters >Devices area as opposed to the Access Point Device Management section.

A. An example of this problem is:

! 
  interface Vlan 106 
   ip address 150.135.47.1 255.255.255.0 
   ip address 172.16.10.1 255.255.255.192 secondary
  ! 

Clean Access Server is in the virtual gateway mode:

• In this case, the Clean Access Server does not care about the number of subnets or their associated VLAN tags. All of the VLAN information passes through with no exceptions.

Clean Access Server is in a gateway (real-ip or NAT) mode:

• In this case, the Clean Access Server also functions as either a DHCP relay or a DHCP server. In either situation, the range of IP addresses allocated depends on the VLAN tag or the gateway address which also depends on the VLAN tag.

  Therefore, the Clean Access Server is not able to differentiate (from a DHCP point of view) between two subnets on the same VLAN. The one limitation is that one of the two subnets on the same VLAN should not use DHCP for address assignment. Instead, the IP addresses need to be statically assigned. This is most likely the case for the 172 subnet in the network since it consists of network gear.

A. System statistics are generated for each Clean Access Server managed by the Clean Access Manager every hour by default. Reported information includes the load factor of each server, maximum load since reboot, memory, and CPU usage.

• Load Factor—Load factor is a number that describes the number of packets that wait to be processed by the server (for example, the current load that is handled by the Clean Access Server). When the load factor grows, it is an indication that packets are waiting in the queue to be processed. If the load factor is greater than 500 for any consistent period of time (for example, 5 minutes), then it is indicative that the Clean Access Server has a steady high load of traffic/packets that come in. You need to be concerned if the number reaches 500 or higher.

• Max since reboot—The maximum number of packets in the queue at any one time (for example, the maximum load handled by the Clean Access Server).

• Mem—The memory usage statistics. There are six numbers (the unit is bytes). These numbers stand for the total, used, free, shared, buffers, and cached memory.

• Cpu—The processor load on the hardware. There are four numbers that provide information about CPU usage (the unit is jiffies - on most systems, a jiffy is a 10 ms time unit). The numbers indicate the time spent by the system in user, nice, system, and idle processes.

For the example provided, system % = 91405324*100/(188552+153+91405324+194183) = 99.58%. Similarly, you can calculate the others as well. However, on a Clean Access Server, system time is typically greater than 90 percent. This is the sign of a healthy system.

A. If you run failover Clean Access Server in virtual gateway mode, then edit the vi /etc/hosts file and change the SS-1 (Clean Access Server) address to the Service IP (virtual address). You need to change them on both Clean Access Servers, active and standby.

• 127.0.0.1 localhost localhost

• 192.168.1.2 SS-1 SS-1

A. If you are unable to add the Clean Access Server to the CAM, then this is a licensing issue. Make sure that the server licenses are generated based on the Primary CAM's ethernet 0 MAC address. The MAC addresses on the server license should match the (Primary) MAC address of the CAM.

1. Go to CAM GUI > Administration > Clean Access Manager > Licensing.

2. Perform a "Remove All Licenses".

3. Re-install the server license files again.

A. In order to resolve the issue, complete these steps:

1. Generate a CSR.
2. Save the private key.
3. Upload the new certificate with the saved private key.