Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

urgent-NAC OOB VG Deplyment

hi all,
           
         Iam in the middle of design of NAC OOB Virtual Gateway.

I have the following doubts regading the placement of NAC Server to my existing Network

I have two Core ( redundancy -HSRP ) running VTP & 25 Edge Switches ( VTP Client )

According to CISCO , we can place NAC Server either in the Core or distribution Switches only , not on the edge switches, in OOB Virtual Gateway deployment.

But currently my existing core switches is not having copper connectivity, customer don't want to invest on core switches.

so I have to forcefully move the NAC server to one of the EDge Switches with both interfaces ( trusted & untrusted ) connected to same Edge switch, but CISCO is not recommending to do so in NAC OOB VG Deployment.

I need to know why we cannot place NAC server at one of the Edge Switches. ( NAC OOB VG Deployment ) , what are the issues behind that ?

One more thing is that , as my Network is running VTP , what are the things to be consider during the design of NAC OOB VG Deplyment.

Iam attaching the Network Diagram, Please go through that.

Expecting your valuable suggestions.

Regards

Dileep

Everyone's tags (1)
3 REPLIES

Re: urgent-NAC OOB VG Deplyment

Dileep,

You can put them on the edges, but you have to make sure you extend all the VLANs necessary to that edge. It's just bad design, but I don't see why it won't work.

Unfortunately you don't have enough details in the map you provided to get a more detailed answer :-)

HTH,

Faisal

New Member

Re: urgent-NAC OOB VG Deplyment

hi faisal,

I know its a bad design, but the Problem I mentioned , Core don't have any ethernet Port , & I can't also put GBIC Copper module.

Can you please brief me why putting the NAC server at the edge switch is not a good design.

Regards

Dileep

Re: urgent-NAC OOB VG Deplyment

Dileep,

Primarily because it makes things more complex and more places for errors to happen. If you think you have control over all the details and can extend your VLANs to the edge without problems, then by all means go for it!

HTH,

Faisal

255
Views
0
Helpful
3
Replies