Support on how to control placement of devices that can not run any agent, such as thin clients, printers, and the like.

[zebula]

I have a OOB layout that has all the the switch ports controlled by the same profile. I would like to be able to place the thin clients on one network, the printers on another and say unix systems on a different one. Right now I have a filter that lets the thin clients onto the network and they are put on the default access vlan via the port profile. The filter is by MAC address.

Is this the only way we can do this?

Can we put stuff on different networks using this method, if so how?

Any help would be appreciated.

[Federico Ziliotto]

Hello,

Through the NAC Appliance only, we'd need to maunually specify each MAC address in the filters and link it to a particular user role/vlan.

The integration of the NAC Profiler would allow more scalable options:

http://www.cisco.com/en/US/docs/security/nac/profiler/configuration_guide/311/p_integration31.html#wp1075255

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[zebula]

Fede,

Thanks for the reply.

Next question is how do you link a mac filter to a particular user role?

I must be missing something obvious since I can not locate how you do it.

[Federico Ziliotto · Accepted solution]

Hello,

When creating a new filter for a specific MAC/IP, we should select the "Access Type" for that device.

As shown in the attached screenshot (taken from NAC 4.8), we also have the option to define the kind of access based on a specific user role.

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[zebula]

Fede,

Thanks for the screen shot. I was looking for the place to associate the filter to the user role, but it only appears when you select either the role or check option, which I did not do.

[Federico Ziliotto]

Glad that it helped ;-)

Feel free to ping us back in case you'd need further help with your NAC setup in the future.

Regards,

Fede

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.