topic Problem with NAC real IP/ layer 3/ in-band in Network Security https://community.cisco.com/t5/network-security/problem-with-nac-real-ip-layer-3-in-band/m-p/1161589#M783321 <P>Hi,</P><P></P><P>I'm deploying a NAC realIP/in-band/layer3, users cannot ping untrusted interface e1 of NAC server, user has to pass core sw 6500 and FW before hitting e1 of NAC server. I have tried to set the gateway of this intterface e1 to itself (as Cisco document) and FW module, but in both cases, user still cannot ping e1.</P><P>Anyone can help me? Much appreciate your replying!</P><P>User -- Core sw 6500 -- FW module (on core sw) -- NAC server -- NAC manager</P> Fri, 21 Feb 2020 11:12:16 GMT namnt2604 2020-02-21T11:12:16Z Problem with NAC real IP/ layer 3/ in-band https://community.cisco.com/t5/network-security/problem-with-nac-real-ip-layer-3-in-band/m-p/1161589#M783321 <P>Hi,</P><P></P><P>I'm deploying a NAC realIP/in-band/layer3, users cannot ping untrusted interface e1 of NAC server, user has to pass core sw 6500 and FW before hitting e1 of NAC server. I have tried to set the gateway of this intterface e1 to itself (as Cisco document) and FW module, but in both cases, user still cannot ping e1.</P><P>Anyone can help me? Much appreciate your replying!</P><P>User -- Core sw 6500 -- FW module (on core sw) -- NAC server -- NAC manager</P> Fri, 21 Feb 2020 11:12:16 GMT https://community.cisco.com/t5/network-security/problem-with-nac-real-ip-layer-3-in-band/m-p/1161589#M783321 namnt2604 2020-02-21T11:12:16Z Re: Problem with NAC real IP/ layer 3/ in-band https://community.cisco.com/t5/network-security/problem-with-nac-real-ip-layer-3-in-band/m-p/1161590#M783322 <HTML><HEAD></HEAD><BODY><P>I have pinged e1 (untrusted) of NAC server already. I have set both managed subnet and static route, something different with Cisco document (Cisco NAC Appliance - Clean Access Server Installation and Configuration Guide, Release 4.1(3)), this document recommends to configure static route for layer 3 deployment, not managed subnet!</P><P>Anyone has documents to deploy this scenario, pls share it to me! Thanks!</P></BODY></HTML> Sat, 10 Jan 2009 17:59:17 GMT https://community.cisco.com/t5/network-security/problem-with-nac-real-ip-layer-3-in-band/m-p/1161590#M783322 namnt2604 2009-01-10T17:59:17Z Re: Problem with NAC real IP/ layer 3/ in-band https://community.cisco.com/t5/network-security/problem-with-nac-real-ip-layer-3-in-band/m-p/1161591#M783323 <HTML><HEAD></HEAD><BODY><P></P><P>Managed subnets are for L2 deployments and Static routes are for L3 deployment.&nbsp; Both can exist on a CAS but for a individual subnet, ti will be one or the other.</P><P></P><P></P><P>If the client and CAS can see each others broadcast, its a L2.&nbsp; If not, its a L3.</P><P></P></BODY></HTML> Sun, 01 Feb 2009 20:35:17 GMT https://community.cisco.com/t5/network-security/problem-with-nac-real-ip-layer-3-in-band/m-p/1161591#M783323 Daniel Laden 2009-02-01T20:35:17Z