NAC/Wireless Design

Unanswered Question


Looking for some input on some design options for NAC with a wireless deployment since OOB and IB are now both options.

In a campus environment of up to 300 wireless users, in-band seems good so that we can have one SSID, but restrict a user login to a role and apply restrictions on the appliance, but I'm concerned about the common issue of the appliance becoming a bottleneck.

My other thought too would be have multiple SSIDs (VLANs) and have multiple appliances handle certain VLANs, but this is pricey.

In wireless OOB, it appears you can only have one "access" VLAN to maps users to (I guess b/c that is all the WLC supports?), so that does not work for us as we need to have employees and guests (among others, separated).

Please correct me on any misunderstandings.

All insight appreciated. Thanks for the input!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
gghayur Fri, 02/27/2009 - 14:58

Your understanding is correct.

For 300 wireless users, you may want to go inband and do enforcement at the NAC server level.

For OOB, you need to make different SSID for different roles.

e.g. Guest, Employees and Contractor

You can look at the configuration example too for OOB Wireless NAC 4.5 here:


This Discussion