Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

NAC Agent ADSSO Slowness?

After a user logs into a machine how quickly should the NAC Agent pop up and beging the ADSSO process?

I have a 4.8 installation in my lab and while the ADSSO works, it takes roughly 1 minute (timed) before the agent pops up and begins the ADSSO process. Once that happens its another 30-45 seconds (again timed - but it varies slightly each login) before the user gets logged in and is placed on the correct VLAN.

The client machine in question is Win7 and AD is 2008R2.

I'm hoping this isn't normal and someone can suggest some tweaks to get the client to respond faster.

In the past I have had an ACS dot1x implemenation and that was so seamless, I was hoping the NAC agent would be as seamless.



Cisco NAC Appliance Agent/AD

Cisco NAC Appliance Agent/AD Server Compatibility for AD SSO

Cisco NAC Appliance supports Windows Single Sign-On (SSO) on Windows 7/Vista/XP client machines and AD on Windows 2000/2003/2008 servers. See Support Information for Cisco NAC Appliance Agents, Release 4.5 and Later for full compatibility details.


Starting from Cisco NAC Appliance Release 4.5(1), the default timeout setting that monitors responses from the CAS changed to 60 seconds. which could impact AD SSO behavior if the response takes longer to come back to the Cisco NAC Appliance system. (For example, if the complete AD SSO process takes 2 minutes, once the 60 second timeout has elapsed, the CAM times out assuming that no response is forthcoming from the CAS that is communicating with the AD domain and automatically moves to the next CAS. If you then examine the CAS following the full 2-minute AD SSO process, you see that the service is actually working.) To help ensure reliable AD SSO behavior, Cisco also recommends verifying that your network DNS servers are functioning and accessible along with your Active Directory servers.

CreatePlease to create content