cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1676
Views
0
Helpful
12
Replies

NAC Implementation

k_vikrams
Level 1
Level 1

I have configuired nac but login page when i am entering user name password then password field becom empty and nothing happend

interface GigabitEthernet1/0/18
switchport trunk encapsulation dot1q
switchport trunk native vlan 998
switchport trunk allowed vlan 507,513,540
switchport mode trunk

interface GigabitEthernet1/0/15
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport trunk allowed vlan 504
switchport mode trunk

User in VLAN 513

2 Accepted Solutions

Accepted Solutions

Faisal Sehbai
Level 7
Level 7

Vikram,

Please turn the checkbox marked "Enable Subnet-Based VLAN retag" off, reboot your CAS and try again.

Thanks,

Faisal

View solution in original post

Faisal Sehbai
Level 7
Level 7

Vikram,

Have you added a trap-receiver in your WLC? The error means CAM didn't get the trap.

Faisal

View solution in original post

12 Replies 12

k_vikrams
Level 1
Level 1

reply if any thinf missing

Faisal Sehbai
Level 7
Level 7

Vikram,

Can you share what your certs look like on the CAS and the CAM?

Also, your managed subnet is for VLAN 501, and your mappings are for 504->513.

You're also requiring the web agent AND the agent on the unauthenticated role which doesn't make sense.

You also have the Web Login options turned on for the consultant role. These are used only for Nessus scanning, so you should turn those off.

Please fix these and send me what your certs look like from both the CAM and the CAS.

Faisal

I am getting user login page but when I am trying to enter user name and password

Password box got blank and nothing happened, What settings I should check

Vikram,

Did you fix the things I detailed? Can you share your certificate setups on CAS and CAM?

Faisal

Hi faisal

I have followed the proces...

without adding management subnet i was able to ping gateway

but now(after Changes) I am not able to ping nac server as well as gateway

please find the attachements

Consultant VLAN- 513   IP - 10.20.20.0

Untrusted- 504 NO IP

L2

interface FastEthernet0/46
switchport access vlan 504   ***** Consultant PC****** ( It Should Consultant VLAN 513 or untrusted VLAN 504)
switchport mode access
snmp trap mac-notification added
spanning-tree portfast

L3

interface GigabitEthernet1/0/15   **** NAC Srv untrusted***
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport trunk allowed vlan 501,504
switchport mode trunk

interface GigabitEthernet1/0/18   ***** NAC Srv Trusted****
switchport trunk encapsulation dot1q
switchport trunk native vlan 998
switchport trunk allowed vlan 507,513,540
switchport mode trunk

interface GigabitEthernet1/0/10   ***** NAC Mgr ****
switchport access vlan 506
spanning-tree portfast

route

10.0.0.0 10.1.8.2  ( 10.1.8.2- Firewall IP )

Faisal Sehbai
Level 7
Level 7

Vikram,

Please turn the checkbox marked "Enable Subnet-Based VLAN retag" off, reboot your CAS and try again.

Thanks,

Faisal

Thanks Faisal Bhai

Thank you...............

wireless user is not able to authenticate getting following error

Unable to process out-of-band login request from [00:21:5D:80:9C:00 ##  10.20.20.5] vikram. Cause: OOB client 00:21:5D:80:9C:00/10.20.20.5 not found.

Faisal Sehbai
Level 7
Level 7

Vikram,

Have you added a trap-receiver in your WLC? The error means CAM didn't get the trap.

Faisal

Hi faisal there was the mismatch the community name

thankssss.....

Dear Faisal

Some times user is not able to ping nac server thats why they  are not able to redirect to nac server

user is getting directly internet connection

cbradt
Level 1
Level 1

Another issue I have found that results in this error is two MAC addresses showing up in the cam table of the switch.  If the first one to show up is not the one used when the user tried to authenticate it will result in this error.

You can verify the cam entries either from the switch or from OOB Management --> Devices.  Look at the Client MAC entry for the port.

Haven't quite figured out how/why the device has two MAC addresses but that is the issue.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: