topic Re: NAC issue in Network Security

NAC issue

kolawole1 — Fri, 21 Feb 2020 11:28:23 GMT

Nac policy is being enforced on a cisco switch.If a non cisco switch is connected to that cisco switch, can nac policy be implemented on the non cisco switch ?

Re: NAC issue

srue — Thu, 21 May 2009 17:39:00 GMT

need more info please.

in band? out of band? nac appliance?

Re: NAC issue

kolawole1 — Fri, 22 May 2009 08:12:43 GMT

Hello,

I am using NAC Appliance 3310 Server -max 500 users and NAC Appliance 3310 Manager -max 3 Servers in in band mode.

Re: NAC issue

halim.abouzeid — Fri, 22 May 2009 08:18:42 GMT

you can do that only if you are deploying NAC in inband mode. You cannot enforce policies on non-cisco switches in out of band mode.

so if nac is deployed in inband mode, your answer is yes.

if nac is deployed in out of band mode, your answer is no.

Re: NAC issue

kolawole1 — Fri, 22 May 2009 09:28:06 GMT

then assume i have Lynksys,3com,peabirdp or hp procurve switch how can i configure thoses switches for snmp mac-notification and link down for the switch to alert the nas ?

Re: NAC issue

halim.abouzeid — Fri, 22 May 2009 09:41:18 GMT

snmp mac-notification and link up/down are used only in out-of-band.

For non-cisco switches you MUST go for inband. The idea is to force all the traffic coming from these switches to go through the NAC server. At all time (before and after being trusted), all the traffic will go through the NAC server.

You also have to note that a NAC server box can either work in inband mode OR out-of-band, but not the 2 at the same time. So you have to either go for inband for all your traffic coming from all your switches, or use 2 different NAC servers, 1 which will be configured in inband mode (for your non-cisco switches), and another one which will be configured in out-of-band mode (for your cisco switches).

you can find a step by step guide on how to configure nac in inband mode here: http://tools.cisco.com/cmn/jsp/index.jsp?id=55785

Re: NAC issue

liyasmacosx — Sat, 18 Sep 2010 01:31:57 GMT

Dear Sir,

We have Cisco NAC installed on our network and found out that when in-band the access speed is half than that of out of band speed.
Could you please highlight us on this issue as why this is happening. Any solution to this problem?

Thanks and Regards,

Re: NAC issue

Faisal Sehbai — Mon, 20 Sep 2010 13:56:22 GMT

Liyas,

In in-band mode all your traffic from all your clients is going through the CAS so CAS can become a choke-point. With OOB setups, the initial traffic goes through the CAS and after authentication/posture you are moved to the core network directly.

HTH,

Faisal