Hi, thanks!

The switch ports are up/up, there's no port-security enabled on those ports. I cannot ping the CAS from the switch where it is connected to. The SSL certificate points to the service ip address, both CAS are sharing the certificate.

We have only configured the primary one so far, and like I said it came up after the reboot and then we lost connectivity to it. The switch is complaining about the native vlan mismatch. The CAS is up and I can access it through console, but I cannot ping anything on the network.

CAS is not a DHCP server.

All the MAC addresses were set correctly.

We do have a failover license for the CAS, linked with the Managers mac address (as specified on the requirements).. However I can't find anywhere in the CAS configuration where I can upload it again or check it.

Anything else I should check???

Thanks and regards,

All the license files are loaded into the NAC Manager.

On the NAC Server, run 'service perfigo config'. Work through the options and take care not to change anything.

Pay attention to these questions:

[Vlan Id Passthrough] for packets from eth0 to eth1 is disabled.

Would you like to enable it? (y/n)? [n]

[Management Vlan Tagging] for egress packets of eth0 is disabled.

Would you like to enable it? (y/n)? [n]

[Vlan Id Passthrough] for packets from eth1 to eth0 is disabled.

Would you like to enable it? (y/n)? [n]

[Management Vlan Tagging] for egress packets of eth1 is disabled.

Would you like to enable it? (y/n)? [n]

Note if they are enabled or disabled. If enabled, select 'y' to enable. Note the vlan number.

If the NAC Server is configured to use 'Management VLAN Tagging', make sure this is not the native vlan on the switch port and an allowed vlan on the trunk.

-Dan Laden

Hello, Thanks again.

vlan tagging is enabled for packets from eth1 to eth0. The management vlan is allowed on the trunk port where the trusted interface is connected to, and it's different from the native vlan.

What's the correct configuration in this situation? Should vlan tagging be enabled or disabled? on eth0, eth1 or both?

I'll have access tomorrow again, I guess I'l try disabling that option, what do you suggest?

thanks again and regards,

Management Vlan Tagging is only needed on the trusted interface.

Vlan Id Passthrough is typically not needed.

-Dan Laden

Hi! thanks again.

I had a chance to check the config again.

The management vlan is set on the trusted interface only. There's no vlan id passthrough.

The problem is still there, is there anything else I should check??

We have different native vlans on the interface per the configuration guide to avoid STP loops on the network. I also read that the same native vlan can be configured if vlan id passthrough is used but I haven't found any more information on how to configure it. Since this is in production I can't risk affecting the network while playing with those values .. Could you please guide me a little on how this configuration can be accomplished? or what else I can check to troubleshoot why my HA config is not working.

Thanks again and regards,

To correct my previous message: i meant VLAN MAPPING instead of vlan id passthrough.

Any ideas will be greatly appreciated.

Thanks and regards,

Please i want to confirm and make sure if it is mandatory to order two NAC Appliances One as Server and One as Manager.

or we can have only one NAC appliance to manage 100 users only?

please confirm me.

Yes, you need both.

The NAC Server is the one that receives the connection requests from the clients.

The NAC Manager controls the servers and is where all the policies are configured.

-----------

About the HA issue, we solved it with the VLAN mapping, we had to enable the eth2 to send UDP hellos between the two CAS's (we had to create a file on the CAS to do that).

IT's doing the failover now but I'm seeing two things:

* Part of the configuration was lost (active directory user to begin), I'm guessing this is not normal, is there any known issue on this?

* Clients are losing connectivity for around two minutes when the failover occurs, is this the normal behaviour???? The service ip is always active and the stand by server immediatly becomes active, but it still takes a while for the client to recover.

CAs is In-band, virtual gateway with High Availability.

Thanks and regards,

very appreciate your response but i want to know if i in need for both server and manager even if i have only one server for less than 100 users.

Yes,

The Manager will control the server (even if it's only one). The server is the one with the license to control 'x' number of users (100 on your case).

All the policies are configured on the manager not on the server. Therefore both are needed,

can by any way we can use only the server and don't order or buy the manager.

The NAC Server receives all its configurations from the NAC Manager (minus IP configuration and SSL certificate). You will need a NAC Manager.