NAC Wireless OOB using VPN-SSO Not working

[ROBERT WATSON]

Dilema

Customer has 4 5508 wireless lan controllers being serviced by 3 NAC Servers

WLC configuration will allow me to put in all 3 NAC Servers in the radius accounting field for VPN-SSO functionality.

Radius acct updates allow sso through the CAS … BUT the wlc will only notify the first nac server in the list as radius acct entry 2 and 3 will only be forwarded if Acct packets timeout to the first.

Now VPN-SSO will only work if the client uses the first nac server and the other 2 are now manual auth only.

What is the solution folks

[Tarik Admani]

Hi

Are you using virtual gateway? I am trying to understand how you could have 3 CAS server on the same L2 segment (same SSID) without introducing a spanning tree loop. Typically you would run a CAS pair in HA and point the accounting server to the trusted interface VIP to handle HA, as far as 3 different servers, if they are on seperate vlans, then you will have seperate SSIDs which you can assign each SSID its own primary accounting server which the clients agent traffic will be switched to.

Thanks,

Tarik Admani

[ROBERT WATSON]

There are 3 seperate Wlan's each mapped to a CAS.  Will re-order per wlan tomorrow thanks for the tip

[Tarik Admani]

Not a problem, I hope that helps!

[Tarik Admani]

Hi

Let me know if that helped.

Thanks