1. On and Off Premise Secure Access
Secure Layer 2 Network Access
What’s new AC 4.2
AnyConnect NAM
Filter multiple machine certificates to ensure the correct certificate is selected without user intervention.
Wireless
Benefits
802.1x
Better Security
Enterprise user to device binding to tighter policy controls
The Network Access Manager is client software that provides a secure Layer 2 network in accordance with policies set forth by the enterprise network administrators. The Network Access Manager detects and selects the optimal Layer 2 access network and performs device authentication for access to both wired and wireless networks. The Network Access Manager manages user and device identity and the network access protocols required for secure access. It works intelligently to prevent end users from making connections that are in violation of administrator-defined policies.
The Network Access Manager component of the AnyConnect Secure Mobility Client supports these main features:
Wired (IEEE 802.3) and wireless (IEEE ) network adapters
Pre-login authentication using Windows machine credentials
Single sign-on user authentication using Windows logon credentials
Simplified and easy-to-use IEEE 802.1X configuration
IEEE MACsec wired encryption and enterprise policy control
EAP methods:
– EAP-FAST, PEAP, EAP-TTLS, EAP-TLS, and LEAP (EAP-MD5, EAP-GTC, and EAP-MSCHAPv2 for IEEE wired only)
Inner EAP methods:
– PEAP—EAP-GTC, EAP-MSCHAPv2, and EAP-TLS
– EAP-TTLS—EAP-MD5 and EAP-MSCHAPv2 and legacy methods (PAP, CHAP, MSCHAP, and MSCHAPv2)
– EAP-FAST—GTC, EAP-MSCHAPv2, and EAP-TLS
Encryption modes:
– Static WEP (Open or Shared), dynamic WEP, TKIP, and AES
Key establishment protocols:
– WPA, WPA2/802.11i, and CCKM (selectively, depending on the IEEE NIC card)
Flexibility Manages both Wired and Wireless media
End-user control optional
NAM module provides end user an intuitive interface for managing wired and wireless network connections.
Pre-login authentication using Windows machine credentials.
Single sign-on user authentication using Windows logon credentials.
Simplified IEEE 802.1X configuration.
IEEE MACsec wired encryption and enterprise policy control.
Multiple EAP methods supported
Capabilities
Improve network operations Administrative control via NAM Service Profile?

2. Cisco Network Access Manager Features - AnyConnect Client 3.1
U.S. government support (Suite B and FIPS compliance for MACsec)
IPv6 support (including dual-stack IPv4 and IPv6)
Corporate network designation
EAP chaining
Windows 8 support*
Mobile broadband (3G) support (beta feature)
Single sign-on enhancements
Start-before-logon (SBL) enhancements
Wireless radio-state enhancements
Enhancements to user-created network profiles
Additional statistics information for troubleshooting
Detection of PSK mismatch
for EAP chaining on Windows 8, you would need the following:
For Network Access Manager, machine authentication using a machine password will not work on Windows 8 / Server 2012 unless a registry fix described in Microsoft KB   (  is applied to the client desktop. This fix includes adding a DWORD value LsaAllowReturningUnencryptedSecrets to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa registry key and setting this value to 1. This change permits the local security authority (LSA) to provide clients like Cisco Network Access Manager with the machine password. It is related to the increased default security settings in Windows 8 / Server Machine authentication using a machine certificate does not require this change and will work the same as it worked with pre-Windows 8 operating systems.
This is specified in release notes:  
So for "EAP Chaining on Windows 8" , read our release notes:  
*EAP chaining on Windows 8 requires a registry fix

3. AnyConnect® NAM v3.1 or newer
EAP Chaining
EAP chaining using EAP-FAST protocol extensions is supported
EAP chaining ties both the machine and user credentials to the device, thus the "owner" is using a corporate asset
Machine credentials are authenticated to the network using 802.1X
When the user logs onto the device, the session information from the machine authentication and user credentials is sent up to the network as part of the same authentication
If both the machine and user credentials are successfully validated, the "owner" is tied to the device, thus deeming it a corporate asset
If both or either of these credentials fail, restricted or denied network access can be given according to the Cisco® Identity Services Engine authorization policy
Cisco Identity Service Engine (ISE) or Later
Credentials
Machine
Machine Authentication
AnyConnect® NAM v3.1 or newer
Machine and User Credentials
Validated AD Database
RADIUS
User
Credentials
User Authentication (includes both user and machine identity types)
User Authentication

4. EAP Chaining Software and Hardware Requirements
 Client
A laptop or desktop computer with an Ethernet network interface card (NIC) or Wi-Fi NIC and one of the following operating systems:
Windows 8/8.1 x86 (32-bit) and x64 (64-bit)
Windows 7 SP1 x86 (32-bit) and x64 (64-bit)
Windows Vista SP2 x86 and x64
Windows XP SP3 x86
Windows Server 2003 SP2 x86
Cisco AnyConnect® 3.1 or later with Cisco® NAM installed
Cisco AnyConnect 3.1 or later Profile Editor
Server
Cisco Identity Services Engine (ISE) System or later
Network Infrastructure
Ethernet switch or Wi-Fi access point configured for 802.1X