topic Re: NAC Host-Based Policies Issue in Network Security

NAC Host-Based Policies Issue

asaldanab — Fri, 21 Feb 2020 10:00:17 GMT

I have a problem... when I try to permit in a temporary role a web page (for example www.microsoft.com) the user can't open it and display security message but when i add the web ip the users can access.... the nac is working on real-ip layer 3...

thanks for your help

Re: NAC Host-Based Policies Issue

cleidh_mor — Thu, 01 May 2008 12:47:45 GMT

Hi,

Have you allowed DNS traffic to a trusted DNS host?

Cheers,

Re: NAC Host-Based Policies Issue

asaldanab — Thu, 01 May 2008 21:40:18 GMT

yes... i did it... 😞

but its a default trusted dns policy... permit to all DNS Servers UDP port 53... is it correct? or i will type the IP address of my DNS manually?

Re: NAC Host-Based Policies Issue

cleidh_mor — Fri, 02 May 2008 08:03:27 GMT

No that's fine, as long as that rule applies to the role of the PC.

Try an nslookup on the PC. What's the output?

>nslookup www.cisco.com

Re: NAC Host-Based Policies Issue

ramkumar-b — Wed, 07 May 2008 07:15:30 GMT

Are u using a proxy server in your network?

Try enabling Parse Proxy checkbox under

CCA Servers-->Filter--> Roles--> Allowed hosts.

Try putting proxy server IP address and port number under CCA Servers---> Advanced ---> Proxy

Re: NAC Host-Based Policies Issue

asaldanab — Wed, 07 May 2008 14:40:39 GMT

hi...

in this moment im not in the company... the next friday i will try

thanks a lot!

Re: NAC Host-Based Policies Issue

asaldanab — Wed, 07 May 2008 14:42:06 GMT

no... i dont have access to internet by proxy server... i have a firewall

😞

the nac server is working in layer 3 real ip gateway... when i put the ip address of the page for example www.symantec.com the users can access... but when i permit the access by host .symantec.com in all options like ends, contain, etc can't access...

Re: NAC Host-Based Policies Issue

cleidh_mor — Thu, 08 May 2008 13:03:29 GMT

Definitely sounds like DNS to me.

Re: NAC Host-Based Policies Issue

asaldanab — Wed, 14 May 2008 16:37:53 GMT

The result of the dns lookup in the host is the next:

*** Can't find server name for address 172.16.48.253: Non-existent domain

*** Default servers are not available

Server: UnKnown

Address: 172.16.48.253

Non-authoritative answer:

Name: com.com.mx

Address: 74.52.164.242

Aliases: www.cisco.com.com.mx

The result of the nslookup in the CAS is the next

[root@CAS-MTY ~]# nslookup www.cisco.com

Server: 172.16.48.253

Address: 172.16.48.253#53

Non-authoritative answer:

Name: www.cisco.com

Address: 198.133.219.25

Help me

Re: NAC Host-Based Policies Issue

asaldanab — Fri, 16 May 2008 21:56:37 GMT

Additionally, I'd like to say that my configuration is Out-of-Band Real-IP Gateway, Does anybody knows if there's a restriction to manage host-based policies?

Regards

Re: NAC Host-Based Policies Issue

gojericho0 — Sun, 18 May 2008 12:10:46 GMT

Thats how mine was setup as well and it should not make a difference. What happens if you try to allow 'all traffic' in your policy. Does it resolve then?

Re: NAC Host-Based Policies Issue

cleidh_mor — Mon, 19 May 2008 08:21:41 GMT

Additionally, could you post a screenshot of your traffic policy and the output from an ipconfig /all on the client?

Thanks,