topic Re: NAC Implementation in Network Security

NAC Implementation

ursshared — Fri, 21 Feb 2020 11:18:29 GMT

We terminate vpn users on an ASA. That is working. The problem is running the remote users through the NAC appliance while not checking other traffic. We have tried restricting all vpn users to a vlan to layer 3 with PBR. None of these options seem to work. What is the best way to run remote users through NAC before allowing access to the network??? Layer 3, Layer 2, InBand, Out of Band, or ???

Thanks.

Re: NAC Implementation

maximcasseus — Fri, 20 Feb 2009 19:42:25 GMT

The recommended way to run your VPN users through the NAC appliance(s) is to implement the L3 InBand deployment.

cheers,

-mc

Re: NAC Implementation

ursshared — Fri, 20 Feb 2009 20:02:14 GMT

Will this work having the remote users restricted to one vlan on the ASA separate from my inside interface? Or will all traffic have to pass through the nac and exempt everything but the vpn traffic?

Re: NAC Implementation

maximcasseus — Fri, 20 Feb 2009 22:24:29 GMT

yes and yes

As you're only inserting the NAC appliance into the existing traffic flow.

The traffic you want to interrogate can be specified via your manage subnets list as well.

if your vpn is not setup yet, you should get it up and working through that dedicated interface and then insert the NAC appliance.

Re: NAC Implementation

srue — Sat, 21 Feb 2009 02:29:59 GMT

if your NAC appliance is more than 1 hop away from your vpn appliance, you can policy route the VPN ip pool through the NAC servers. all other traffic will be routed normally, w/o going through NAC.