04-29-2009 06:29 AM - edited 03-09-2019 10:15 PM
What would be the pros and cons of installing the Clean Access Agent in a L2/L3 OOB scenario?
05-01-2009 06:43 AM
with OOB, you can't do bandwidth throttling or apply ACLs, since once the user is authenticated properly they are out of band. (you can apply those things only to user roles such as quarantine, temporary, etc). on the other hand, the CAS is not a bottleneck with OOB either. with OOB, you'll need to roughly duplicate your LAN and dhcp scopes for the unauthorized vlans/subnets.
that's just off the top of my head.
05-07-2009 10:16 AM
Hi there,
A couple of other points to note about IB vs OOB:
(1) OOB will only work with Cisco switches and even then you need to check since it may not work with some older Cisco switches. With InBand (IB) the switch type is irrelevant.
(2) OOB mode can now be supported with Cisco wireless (centralised using WLC) but only if CAS has L2 connectivity to the WLC; NAC v4.5 and WLC v5.1 onwards. Originally NAC for wireless was only supported using IB mode.
This link discusses the different options that may be best suited to your environment:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/45/cas/s_deploy.html
Hope this helps.
Thanks
Russell
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide