NAC 4.5 OOB, WLC design question

Answered Question
Feb 24th, 2009
User Badges:

We have a centralized NAC server design with a large number of remote sites. With 4.5, I have heard you need Layer 2 adjancency for the WLC's to the NAC servers even if using OOB? Is this correct? This is a serious limitation if so. thanks

Correct Answer by gghayur about 8 years 3 months ago

This is correct. You need to have layer 2 adjacency between the CAS Untrusted and WLC. Also, CAS needs to be in Virtual Gateway.


in next major release, we are looking into removing this limitation.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
don.click1 Tue, 02/24/2009 - 07:20
User Badges:

I dont have an answer, but i am also very interested in this. We currently are planning to upgrade to NAC 4.5 for the added ability to do OOB for Wireless.

Aaron D Tue, 02/24/2009 - 07:27
User Badges:

I have found out from Cisco that L2 adjancency is required. Apparently, the un-authenticated VLAN is sent to the CAS by default. The CAS then assigns based on role after authentication, THEN goes out of band.

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/45/cam/m_woob.html#wp1148691

Wireless Out-of-band implementation of Cisco NAC Appliance requires the following to be in place:


•Cisco Wireless LAN Controllers must be supported models that use at least the minimum supported version of IOS (supporting SNMP traps). See Table 5-2.


•Cisco Wireless LAN Controllers must be Layer 2 adjacent to the Clean Access Server(s) with which they interoperate to support wireless client login.


•Clean Access Servers supporting wireless client login and authentication must be installed and configured in Virtual Gateway mode.


•Your Cisco NAC Appliance product license must enable Wireless OOB.


Correct Answer
gghayur Fri, 02/27/2009 - 14:33
User Badges:

This is correct. You need to have layer 2 adjacency between the CAS Untrusted and WLC. Also, CAS needs to be in Virtual Gateway.


in next major release, we are looking into removing this limitation.

a.moreck Fri, 07/31/2009 - 14:47
User Badges:

Is there a special license that is needed for wireless OOB?

Actions

This Discussion

 

 

Trending Topics: Other Wireless Mobility

client could not be authenticated
Network Analysis Module (NAM) Products
Cisco 6500 nam
reason 440 driver failure
Cisco password cracker
Cisco Wireless mode