NAC Configurations

[kydaniel411]

Hi Experts,

I'm new to NAC.

At the moment I have some questions regarding the installation and would seek your help:

Requirements:

1. CAM and CAS are installed in Intranet

2. When PC is plugged into the network, CAS will assign an IP with minimal access(separate VLAN)

3. When PC is passed through REGISTRY check, allow use network resources(separate VLAN)

Questions:

1. Is the Ethernet1 port is required to use in CAS?

2. Can this be called in-band configuration?

3. What configuration is needed if I need to make specific LAN port in switch “route to” another VLAN?

4. Where should I set the DHCP?

Thanks in advance!

Regards,

Daniel

[kydaniel411]

Hi Experts,

Do anyone can provide assistant on this?

Regards,

Daniel

[Nicolas Darchis]

I really strongly sugges that you read the CAM and CAS configuration guide. The deployments types for NAC are complex and you need to understand them. One cannot simply give you advises as there is not "one" way to go.

1) It's advised to have a trusted and untrusted (eth0/eth1) port on CAS.

2) Inband has nothing to do with what you mentioned. Inband means that client traffic wil always flow through the CAS. In out of band, once the client is authenticated, he's not going through the CAS anymore for his traffic

[kydaniel411]

Dear Nicolas,

Thanks for your advice.

For CAS eth1, is that fine if I connect to different VLAN of the same Cisco switch as the eth0?  Will the config be simple as putting the appropriate VLAN ID in Cisco switch and in CAM/CAS?

From your advice that most application should choose OUT-OF-BAND application, is that correct?

Regards,

Daniel

[Nicolas Darchis · Accepted solution]

the ports have to be in different vlans if you want to avoid an awful loop. One will have the trusted vlan and one the untrusted vlan.

If out of band was so much better, inband would not exist. No one can tell you "go for this", you have to decide on your own.

In band allows for traffic policies restrictions, easier logoff, etc... etc ...

[kydaniel411]

Dear Nicolas,

Thanks for your advice.

I'm currently trying to set-up, and will consult if needed.

Many thanks!

Regards,

Daniel