Hi
NAC State is not only for CWA, it is also used for 802.1x. The concepct of NAC state come from the past. You can see that on the WLC for AirOS you have three option about NAC State:
NAC ISE , SNMP NAC and None.
You can choose NAC ISE for use ISE Server as NAC and you can choose SNMP NAC for NAC out-of-the band.
If you were to deploy Wireless out-of-band you need to choose SNMP NAC but I never saw this kind of deployment.
Table 4-1 Wireless In-Band vs. Out-of-Band Deployment
Wireless In-Band Deployment Characteristics |
Wireless Out-of-Band Deployment Characteristics |
|
The Clean Access Server (CAS) is always inline with user traffic (both before and following authentication, posture assessment and remediation). Enforcement is achieved through being inline with traffic.
|
The Clean Access Server (CAS) is inline with user traffic only during the process of authentication, assessment and remediation. Following that, user traffic does not come to the CAS. Enforcement is achieved through the use of SNMP to coordinate with Wireless LAN Controllers (WLCs) and to assign/reassign VLAN assignments.
|
|
The CAS can be used to securely control authenticated and unauthenticated user traffic.
|
The CAS can control user traffic during the authentication, assessment and remediation phase, but cannot do so post-remediation since the traffic is Out-of-Band.
|
|
Bandwidth restricted to maximum allowable throughput for installed Clean Access Server(s).
|
Out-of-Band bandwidth not restricted by Clean Access Servers in network, as all client traffic bypasses CASs once clients are authenticated.
|
