Hi,
Please explain the vlans one more time, is the vlan 101 for clients that are unauthenticated and then being mapped over to 11 once their traffic is inspected and permitted (trusted). If so, you will need to setup vlan mapping from 101 to 11 you will need to configure a managed subnet entry (an unused ip address from vlan 11 that is tagged with vlan 101).
then you will have to make sure that vlan 101 is a l2 vlan and that all switches that are connected to the clients are set to trunk vlan 101 and 11 to client. Also the port setting of all clients will need to be set to vlan 101.
As far as setting up oob there is more to it, you will need to open a TAC case if you are looking for configuration assistnace with the nac system.
I hope that gets you started or provide some help.
Tarik admani