NAC L3 OOB not working accross WAN

Answered Question
May 19th, 2010

I am setting up a proof of concept lab for a NAC installation.

I am using Cisco Catalyst 3550 and 2950 switches (the actual environment is using 3750 and 2960 and 2950 switches) and have the NAC set up in central L3 OOB configuration. In this configuration i have a single NAS and NAM at the "MAIN_SITE" and then two branch sites "BRANCH1" and "BRANCH2".

At the main site, the OOB works fine and when a user logs on, the port is moved from the unauthenticated VLAN (290) to the role based VLAN (200) However, at the "branches" the switches are not placing the port into the role based VLAN, nor if a port is in VLAN 200 and a PC is plugged into that port does the port switch to VLAN 290 (unauthenticated).

Sniffing the traffic with Wireshark i see the SNMP sets being sent by the NAM to the switch telling it to place the port into VLAN 200, but the switch is not doing it.

My write strings are set up correctly and the NAM is able to set up the initial commands on the switch for the NAC ("snmp trap mac-notification added" commands to the ports).

Can anyone say what is wrong?

Sachin

I have this problem too.
0 votes
Correct Answer by Faisal Sehbai about 6 years 6 months ago

Sachin,

Needs to be at least 12.1(14)EA1

Check this link for all the supported codes and switches you need for OOB: http://bit.ly/SwitchSupport

HTH,

Faisal

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
sganpat Wed, 05/19/2010 - 19:18

I defaulted the 3550 switch in the WAN and reconfigured it and it works now. I tried the same procedure for the 2950 switch but no dice. I replaced the 2950 switch with a 3550 that worked.

Can anyone say if there is an issue with teh 2950 switch for L3 OOB? I don't have another 2950 switch to test with.

Sachin

sganpat Thu, 05/20/2010 - 15:32

*sigh*

Such a rookie mistake.

Sometimes the simplest answer is the most correct.

Thanks for you help.

Actions

This Discussion