06-27-2012 02:47 PM - edited 03-10-2019 07:15 PM
Dilema
Customer has 4 5508 wireless lan controllers being serviced by 3 NAC Servers
WLC configuration will allow me to put in all 3 NAC Servers in the radius accounting field for VPN-SSO functionality.
Radius acct updates allow sso through the CAS … BUT the wlc will only notify the first nac server in the list as radius acct entry 2 and 3 will only be forwarded if Acct packets timeout to the first.
Now VPN-SSO will only work if the client uses the first nac server and the other 2 are now manual auth only.
What is the solution folks
06-27-2012 03:27 PM
Hi
Are you using virtual gateway? I am trying to understand how you could have 3 CAS server on the same L2 segment (same SSID) without introducing a spanning tree loop. Typically you would run a CAS pair in HA and point the accounting server to the trusted interface VIP to handle HA, as far as 3 different servers, if they are on seperate vlans, then you will have seperate SSIDs which you can assign each SSID its own primary accounting server which the clients agent traffic will be switched to.
Thanks,
Tarik Admani
06-27-2012 04:10 PM
There are 3 seperate Wlan's each mapped to a CAS. Will re-order per wlan tomorrow thanks for the tip
06-27-2012 04:24 PM
Not a problem, I hope that helps!
06-30-2012 08:36 PM
Hi
Let me know if that helped.
Thanks
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide