Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Clean Access Agent

What would be the pros and cons of installing the Clean Access Agent in a L2/L3 OOB scenario?


Re: Clean Access Agent

with OOB, you can't do bandwidth throttling or apply ACLs, since once the user is authenticated properly they are out of band. (you can apply those things only to user roles such as quarantine, temporary, etc). on the other hand, the CAS is not a bottleneck with OOB either. with OOB, you'll need to roughly duplicate your LAN and dhcp scopes for the unauthorized vlans/subnets.

that's just off the top of my head.

New Member

Re: Clean Access Agent

Hi there,

A couple of other points to note about IB vs OOB:

(1) OOB will only work with Cisco switches and even then you need to check since it may not work with some older Cisco switches. With InBand (IB) the switch type is irrelevant.

(2) OOB mode can now be supported with Cisco wireless (centralised using WLC) but only if CAS has L2 connectivity to the WLC; NAC v4.5 and WLC v5.1 onwards. Originally NAC for wireless was only supported using IB mode.

This link discusses the different options that may be best suited to your environment:

Hope this helps.