NAC L3 OOB does not not on WAN

I'll put up proof of lab validation for installation of the NAC.

I use Cisco Catalyst 3550 and 2950 switches (the real environment is using 3750 and 2960 and 2950 switches) and have defined NAC in Central L3 OOB configuration. In this configuration, I have a SIN and NAM "MAIN_SITE" and then two sites branch "BRANCH1" and "BRANCH2.

On the main site, the OOB works very well, and when a user logs in, the port is moved from the VLAN authenticated (290) role service VLAN (200) However, in the 'branches' switches do not put the port in the role in function of VLAN, or if a port is in VLAN 200 and a PC is connected to this port don't switch port to 290 of VLAN (unauthenticated).

Sniff traffic with Wireshark, I see SNMP sets sent by the NAM to the switch to tell it to place the port VLAN 200, but the switch does not.

My writing strings are configured correctly and the NAM is able to implement initial orders on the switch for the NAC ('mac-added notification of snmp trap' orders for the ports).

Can we say what is the problem?

Sachin

Sachin,

Must be at least 12.1 (14) EA1

Visit this link for all the switches you need for OOB and supported codes: http://bit.ly/SwitchSupport

HTH,

Faisal

Tags: Cisco Security

Similar Questions

  • Anwser file for HP OEM Installation OOBE does not.

    Goodday,

    I need to deploy 20 HP Workstation Z210 around my business.

    I have prepared an Z210 I like too. Then I did Sysprep on the Windows 7 Installation.

    With Windows deployment services, I took the image off the power.

    Now I have a good image for the 19 Z210.

    I had an answer for the OOBE file.

    But the problem I have is that the HP OOBE ask with Windows language I want.

    And I can not find the right answer for this in Windows System Image Manager.

    Does anyone have experience with this?

    I have no personal experience with sysprep and answer files without assistance for OOBE but this thread phpcs.com entitled "Windows 7: Unattended Windows OOBE after Sysprep", may be what you're looking for. ' "

  • Cisco NAC appliance - after a success does not change users to connect to the vlan propper

    Hello

    I am new to cisco NAC BURNERS and I have to troubleshoot an implementation. It is a real OOB IP gateway configuration. Users can connect to the Pentecost the CCA, but after the connection of this success, they remain on the role not authenticated, as well as on this vlan. I checked the SNMP protocol and seems to work very well. Also, I checked the logs on nac_manager.log and there is nothing surprising, in fact I see nothing about this user or IP address that connects.

    Also the user does not appear on the list of users online on cam.

    Can someone help me figure out how can I fix? version 4.8, I'll post any information requested

    Thank you

    We recently had the problem with Windows AD SSO and Windows 7 clients.

    Would authenticate the XP clients very well, however, Windows 7 clients would not authenticate and will remain just on the authenticated vlan.

    Our question was looking for CASE SSO account, we installed on AD. It only support the encryption, WHICH has no Windows 7 64. We turned off "Use OF THE encryption" on the account authentication UNIQUE AD and re-tested.

    What are the parameters of the port-profile to which is applied the switchport?

    What is the map settings vlan ports trunk not approved or confidence?

  • Re-evaluation of the NAC 4.8 Passive does not work

    Hello

    After an upgrade to 4.8.0, we would like to use the passive re-evaluation function with L2 OOB.

    Everything is configured properly according to the Cisco NAC docs (enable OOB Logoff, user roles-> activate Passive reassessment).

    However, the sign-out OOB feature works well, for example. What a victory of logoff user, the user disconnects NAC.

    In the first times that the PrA works well, the CAM poster report revaluation records failed with red flags, but now it shows nothing that associated PRA.

    (I know, the poster reports only PrA records failed.).

    Try to reload all the elements of the CAM CASE HA, HA, but nothing has changed.

    Any suggestion?

    Thank you very much

    Attila

    Hi Attila,

    The debugs Agent, I see that the Agent reports the failure for the following conditions:

    % NACAGENT-6-REQUIREMENT_PROC: % [sev = info] [func = Rqmt::completeCheck]: check the result of rqmt [MS: hianyzo Windows frissites Windows XP (BKV)]:FAILED

    That't the only requirement that fails and it is also reported on the "NACAgentReport.xml" file that is part of the package you uplaoded and it has not been quantified.

    I think the problem is actually with the following parameter "default PrA on failure action - continue '.

    Please, set it to "allow the user to fix" or "Logoff user immediately" and check if the behavior is different.

    If this does not help, please open a TAC service request in order to study it.

    Thank you

    Federico

    --

    If this answers your question please mark the question as "answered" and write it down, so other users can easily find it.

  • I wan to save my history Web sites, but my computer does not record. I go to tools > options > privacy and try to "save history", but it goes back to "use the custom settings for history"... I'm all down on those checked so it should save, but it do

    I wan to save my history Web sites, but my computer does not record. I go to tools > options > privacy and try to "save history", but it goes back to "use the custom settings for history"... I'm all down on those checked so it should save, but it doesn't.

    Thank you for taking the time to help me!

  • Satellite T110-10 x - LED WAN wireless turn does not on

    Hi guys,.

    I have this model * T110-10 x * and I was wondering what should the front LED for Wireless WAN should be flashing or turning?
    It comes to the specifications of the model page:
    [http://eu.computers.toshiba-europe.com/innovation/product/Satellite-T110-10X/1076616/ | http://eu.computers.toshiba-europe.com/innovation/product/Satellite-T110-10X/1076616/]

    I bought the USB 3 G modem which works fine, but I was just curious to know if the laptop must have a built-in 3G modem, and if yes, what is the meaning of the key FN and the LED as this model does not have a built-in modem.

    Thank you.

    Hi mate

    Please take a look in the user manual which must be preinstalled on the laptop.
    There is information that the FN buttons in combination with the F1 - F12 keys would have enabled some features/options.
    The WAN/Wlan can also be switched on and off using the FN key!

    >.. .should forward for Wireless WAN LED should be flashing or rotating
    The LED must be lit and it not blink...

  • SA520W does not get an IP on the WAN option

    We use a SA520W as our main router and have a fiber attached to the interface default WAN connection. We would like to improve our availability using a secondary internet connection on the WAN interface option.

    We bought a router dovado tiny 4g for this another connection. It acts as a dhcp server, but the Cisco router does not get an IP address from the dovado router. The router works as expected when it is connected to a normal computer. But somehow the cisco router does not get an IP address.

    I also tried to put a static IP address for the Cisco router, but that did not help either. The dovado router is setup deliver ip in the range of 192.168.0.2 - 254

    Link is established, but State wide AREA network is down. Any ideas?

    Christian,

    Make sure that the port option is set to WAN and WAN mode = MODE of LOAD BALANCE. If not pull an ip address or to negotiate a connection.

    Jasbryan

  • I wana make my window see - across borders, but my version of vista does not have this setting. where can I get this setting?

    is there anything I can download to install the transparency setting?

    Very likely not.  If you have an old graphics (video card) card that does not support Aero, who's who.  In addition, if you have Vista Basic you are more able to get the Express upgrade to add this feature as Vista is currently in the extended Microsoft support.  You can check for updated display card drivers that could help, but maybe not.

  • Capsule WiFi does not

    A year and half ago we bought a new Mac and the Time Capsule (TC) to go with it. I tried to set up at the start and think about this topic, I do not think that it has never worked properly. I say this because we got a new modem without router because time Capsule has an inside, and we are unable to connect to wifi. I have a TB Ethernet connection and if I can get online in this way, but the WiFi does not work. Last night, I went through and set up and the WiFi worked, but today it no longer works and I can't seem to do it again.

    The indication of WiFi signal says I'm connected, on my Mac and on our phones, but when you disconnect from data it no longer works. It's very frustrating because I don't want to have to go back to a modem/router of the rental of our cable company.

    We have just upgraded to OS X El Capitan 10.11.6

    I'm pretty confident that the problem is with time capsule, the wifi works with the other router.

    When it worked last night I created everything from scratch. But I do not think that I would have to do every time I need to use the internet. I also tried to create a WiFi with a custom DNS but that doesn't work anymore.

    Any help would be appreciated.

    Thank you.

    Amazing!

    I am so embarrassed but understand that I would update in the case where everyone does the same thing.

    When I put in 1.5 years ago I went from ethernet cables. The Ethernet cable from the modem was connected to the LAN port and the Ethernet cable from the Mac was connected to the WAN. Once I put the cable from the modem to the WAN everything has worked.

    Sometimes, just come back to square one.

  • I just got a new modem (Arris SB6190) and now my Airport Extreme does not connect.  It worked fine with the previous modem (a rented one TWC).  Help!

    I just got a new modem (Arris SB6190) and now my Airport Extreme does not connect.  It worked fine with the previous modem (a rented one TWC).  Help!

    Always recommended to reset the airport back to settings by default and then set up again whenever you have a new modem or change your Internet Service provider.

    Turn off the new modem for at least 30 minutes. More is better.

    Perform a hard reset on the AirPort Extreme, then it turned off.

    Make sure that the Ethernet cable connects the modem to the "O" on the AirPort Extreme WAN port

    After the power of the modem 30 minutes down, turn on the modem and let it run for at least 5 minutes by itself.

    Then, turn on the airport and let it run a few minutes

    Set up AirPort Extreme again

    Important note... There are many reports of problems with the modem Arris SB and airports. Both are great products, but they do seem to work perfectly together for some users.

  • Re: Satellie A100-151 work/does not start

    Hello!

    My A100-151 does not work as it should...
    I expelled the power supply lead for an hour. All of a sudden I'd start, inserted the power supply, but the State led the of are turned off and nothing has worked. The laptop doesn't fall down or anything else... It fit on my table...
    No. led is on, even when the battery is in or not.

    Can it be a motherboard problem?
    PS: sry my English is not the best :)

    Greetings Sebbohp

    Hello

    It is possible that your adapter is defective and that the battery is empty. Then the laptop will not light. But of course the problem of the motherboard is possible also

    You have validated the idea to use a voltmeter to check if the AC adapter is working. Well, there is a possibility to check if the adapter is ok.

    > Can I use a universal power or else cable
    I would recommend using the Toshiba power adapter that is specially designed for this series of laptop.
    But if you wan to use the universal AC adapter then this adapter must supports the same watt, volt ampere, features etc as the Toshiba power adapter!

    Best regards

  • FVS336Gv3 multi-NAT inbound firewall rules does not

    I have about 30 Netgear FVS338 and a few FVS336Gv2 routers in use. I use for firewall and provide multi-NAT between industrial machines and WAN. The configuration was changed on Gv3 models and I can't get an answer behind the firewall or router in the diagnostics page when you use the WAN address.

    In the examples below the WAN is 10.62.

    Figure 1. Two different devices with two different configuration options.

    Figures 2 and 3. The first is bad - it would only connect from this address. Have I set up another correctly to the NAT WAN to LAN 10.3.110.215 address 10.62.31.55 address?

    Q1: Is Figure 3 configured correctly?

    Q2: Why is it forcing me to create a range of addresses? On the older routers, I had the opportunity to address.

    Q3: Is anyone aware of any problem with this router?

    For anyone having the same problem, the FVS336Gv3 requires the manual addition of each new address WAN-side. He is buried in the menu structure:

    Figure 1. Network configuration | WAN settings | WAN configuration. WAN1 - Edit.

    Figure 2. Select the secondary addresses.

    Figure 3. Add the required WAN addresses.

    Now configure the inbound firewall rules:

    Figure 4. Security | Firewall rules. Add or change. Note that the WAN secondary addresses are available in the drop-down list address WAN IP.

    Password

    There seems to be a problem with this router about the session timeout. I got them several times on the navigation menu and log on again and renavigate. Idle time-out is set to 90 minutes. I never saw this problem on routers earlier.

    Also, note that the password field now has a limited character set. for example, it does not accept ' $'.

  • How to extend the range of my Airport Extreme Base Station (802. 11 a, c) using a relay of Airport Express (802.11n).  Airport Utility (V635.2) says that this version does not support the relay.  That is what it is?

    How can I extend the range of my Airport Extreme (802. 11 a, c) using an Airport Express (802.11n) point.  Airport (V635.2) utility does not recognize the Express on its screen?  I have to buy equipment?  I'm on a MacPro OS X 10.10.5.  Thank you.

    AirPort utility that ships with OS X 10.10.5 supports base stations as 802.11ac & 802.11n AirPort. It should be able to configure both of your base stations for a scope (wireless connected base stations) or roaming types (base station connected Ethernet) wireless networks.

    When you initially configure the Wan, it helps to keep the two base stations in the same room. Once configured, you can move the base station that extend to the desired location. The important key is that the final positioning of the station that extends the base must be understood that it's to expand in order to maintain sufficient bandwidth to the station remotely for clients from network connected. Please check the following airport user tip for more details.

  • Windows 7 Home Edition premium does not start

    Hello... I have a HP G60 Notebook PC with windows 7 home premium (original)

    I was with my computer laptop to surf the net when suddenly he stopped and when I tried to start again... .the sdcreen came, and then a small dialog box pops up saying "Windows cannot complete the installation. To install Windows on this computer, run the Setup again.

    I stopped and replace the battery, tried some other stuff, but it did not work... Help, please!

    Go ahead and try the following steps for me.

    When you are prompted with error cannot complete installation:

    Press SHIFT + F10 to bring up the command prompt.

    type in MMC

    Click file-> add/remove snap... (Or CTRL + M)

    Select Computer Management (Double click and finish on the Local computer)

    Click OK

    Double-click (Local) computer management-> tools in system-> local users and groups-> users-> Double click on administrator-> uncheck account is disabled-> OK

    Now make a click Administrator-> set-> Set Password right a decent password to start.

    Now restart.  Should be good to go.

    If this does not work, try next step:

    SHIFT + F10 to bring up the command prompt.

    type: CD C:\windows\system32\oobe

    type msoobe /a

    Come in

    Make a generic account and password.  hit finish (if it asks for a product key and you have one, enter it now.  If OEM/no key required, just finish).  The date/time value.  Finishing.

    Turn it back on.

    Should be good to go.

    If this is not the case, let me know what happens.

    THX

  • Printer HP B209a does not get the IP address of my router

    Computer is a HP G71 running under Windows 7 64-bit

    Router is a NETGEAR's WNR3500L with the latest firmware and a unique SSID

    Using the latest version of the software install HP B209a

    Towards the end of the installation for the wireless feature, the installation stops and tells me that my PC is on a network other than my printer.  All wireless devices connected to my router have 10.0.0 # IP addresses.  Through many installs the printers IP address is constantly as 192.168.0.109.  The summary on the printer wireless shows my unique routers SSID but when I open my router software and devices attached, the printer is not listed.  My router is attached to a simple DSL modem with no wireless features.  I tried the following hotfixes recommended in these forums.

    1. Connect the printer to the router through WPS with push button.  Connection is returned as a success, but identified printer router SSID as grabbled alphanumeric characters and not an IP address.  Router does not show the printer in the devices.  During the printing installation software PC and printer fail to communicate when the USB cable is connected.
    2. Connect the printer to the router through WPS with PIN.  Connection is returned as a success, but all the information in the router has been changed and all other wireless devices disconnected.  Connection to the router has shown the SSID THAT became grabbled of alphanumeric characters and the security key was changed.  No wireless device was attached to the router, but the wired connections remain intact.  Fixed key SSID and security.  All other wireless devices back in place, printer does not have.
    3. Ping network devices.  Ping 10.0.0.1 to 7 came back as successful.  192.168.1.109 ping failed.
    4. IP address of the printer has entered into a browser address bar.  Returns a Google search page, but not for access to the network printer.  Address of more than one entry address bar and couldn't connect to 10.0.0.1 (router) and 192.168.0.1 (DSL modem)
    5. Unplug the DSL modem router.  All wireless devices to connect to the router but do not have access to the internet.  During the installation of the printer software, when you are prompted to connect the USB to the PC, printer and PC fail to communicate.
    6. Turned off the Windows Firewall, both public and private without success
    7. Used the Hp network diagnostic utility and it does not can find printer.

    I have installed and uninstalled the software several times.  The printer has always identified my identifier SSID is correct and the network key.  But during the finalization of installation I get the message and cannot connect PC printer because they are on different networks.  I have no idea where the printer receives the IP address.  It should be an address from the router, but it is not.  IP address of the modem DSL IS in the format # 192.168.0, but given that the modem is the base model with the wireless or network capabilities, the printer cannot logically connect to it.  I tried to unplug the router and the printer several times without success.  The possibility of changing the IP of the printer through the browser is not possible for the reasons given in 4.  What are the other options to change the IP address of the printer?  If I can assign an address # 10.0.0, I think it will solve my problems.

    Is your DSL modem is a modem/router combo (most are)?  If so, it probably has a structure of 192.168.0.X and is probably a wired router (only).

    This DSL modem/router is attached to the WAN, or one of the LAN ports on the back of the Netgear?  Try to move to the other type of port, and then restart both routers.

    On the front of the printer, click the settings 'Restore defaults' and wireless the wireless radio.

    Finally, the Netgear settings, here are some tips:

    1 make sure that DHCP is active, the SSID is not hidden and that MAC filtering is not enabled.

    2. ensure that the 802.11 g mode (as well as other modes is very well).

    3. use WPA or WPA encryption, not WEP (it is not secure and may cause connection problems)

    4 change the channel of the Netgear to 11 (Yes, I know it makes no sense, but it works).

Maybe you are looking for