Solved: NAC issue

kolawole1 · ‎05-20-2009

Nac policy is being enforced on a cisco switch.If a non cisco switch is connected to that cisco switch, can nac policy be implemented on the non cisco switch ?

halim.abouzeid · ‎05-22-2009

you can do that only if you are deploying NAC in inband mode. You cannot enforce policies on non-cisco switches in out of band mode.

so if nac is deployed in inband mode, your answer is yes.

if nac is deployed in out of band mode, your answer is no.

View solution in original post

halim.abouzeid · ‎05-22-2009

snmp mac-notification and link up/down are used only in out-of-band.

For non-cisco switches you MUST go for inband. The idea is to force all the traffic coming from these switches to go through the NAC server. At all time (before and after being trusted), all the traffic will go through the NAC server.

You also have to note that a NAC server box can either work in inband mode OR out-of-band, but not the 2 at the same time. So you have to either go for inband for all your traffic coming from all your switches, or use 2 different NAC servers, 1 which will be configured in inband mode (for your non-cisco switches), and another one which will be configured in out-of-band mode (for your cisco switches).

you can find a step by step guide on how to configure nac in inband mode here: http://tools.cisco.com/cmn/jsp/index.jsp?id=55785

View solution in original post

srue · ‎05-21-2009

need more info please.

in band? out of band? nac appliance?

kolawole1 · ‎05-22-2009

Hello,

I am using NAC Appliance 3310 Server -max 500 users and NAC Appliance 3310 Manager -max 3 Servers in in band mode.

halim.abouzeid · ‎05-22-2009

you can do that only if you are deploying NAC in inband mode. You cannot enforce policies on non-cisco switches in out of band mode.

so if nac is deployed in inband mode, your answer is yes.

if nac is deployed in out of band mode, your answer is no.

kolawole1 · ‎05-22-2009

then assume i have Lynksys,3com,peabirdp or hp procurve switch how can i configure thoses switches for snmp mac-notification and link down for the switch to alert the nas ?

halim.abouzeid · ‎05-22-2009

snmp mac-notification and link up/down are used only in out-of-band.

For non-cisco switches you MUST go for inband. The idea is to force all the traffic coming from these switches to go through the NAC server. At all time (before and after being trusted), all the traffic will go through the NAC server.

You also have to note that a NAC server box can either work in inband mode OR out-of-band, but not the 2 at the same time. So you have to either go for inband for all your traffic coming from all your switches, or use 2 different NAC servers, 1 which will be configured in inband mode (for your non-cisco switches), and another one which will be configured in out-of-band mode (for your cisco switches).

you can find a step by step guide on how to configure nac in inband mode here: http://tools.cisco.com/cmn/jsp/index.jsp?id=55785

liyasmacosx · ‎09-17-2010

Dear Sir,

We have Cisco NAC installed on our network and found out that when in-band the access speed is half than that of out of band speed.
Could you please highlight us on this issue as why this is happening. Any solution to this problem?

Thanks and Regards,

Faisal Sehbai · ‎09-20-2010

Liyas,

In in-band mode all your traffic from all your clients is going through the CAS so CAS can become a choke-point. With OOB setups, the initial traffic goes through the CAS and after authentication/posture you are moved to the core network directly.

HTH,

Faisal