NAC REAL IP GATEWAY BAND

Similar Questions

• Actual gateway IP process to strip the NAC

  Hi all

  I did a lot of research, and I can not find good answers to some of my questions. All the big questions are answered for out-of-band configuration, but I find that it is assumed that this understanding in the Strip is taken for granted lol... I guess I'm slow = P

  1. How does the gateway IP In-band real?
  2. What is the point of the 30 subnets?
  3. Are there any access/auth pairs VLAN configurations in the band?
  4. How does quarantine work?
  5. I read that the NAC server cannot send traffic on untrusted port to a VIRTUAL LAN and that you are not allowed to trunk port. This means that there is no support for several VLAN reliable, mapped to a single server at the NAC?
  6. Can you do role with configurations mapping in the band?

  Assistance for all or part of these questions would be GREATLY appreciated!

  Thank you a lot =]

  ~ Xavier.

  Hi Xavier,.

  I'll try to answer your questions

  1. How does the Strip Real-IP Gateway?

  The CASE works in routed mode, if you have different IP addresses (on different subnets) on interfaces approved and unapproved. Because the CASE does not support routing protocols, routing must be configured through static routes

  2. What is the point of the 30 subnets?

  The idea is to have small subnets for your customers so that with this config IP customers in authentication VLAN should through the CASE even to talk to other clients on the same subnet L2.

  Click here for an explanation:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/47/CAs/s_dhcp.html#wp1057889

  3 is there access/auth pairs VLAN configurations in the band?

  If you ask if there is mapping VLAN, then the answer is NO, as the purpose of the VLAN mapping must * bridge * traffic between approved and unapproved mapped VLAN, but in real-IP the L3 routing traffic CASES.

  4. How does quarantine work?

  When a client is quarantined, it works the same way as OOB, as in this phase, the client is always online to the CAs.

  So the concept is assigned to the CASE by the temporary user or the role of midlife and he applies a traffic policy you've set up temporary or the role of midlife.

  5. I have read that the NAC server cannot send traffic on untrusted port to a VIRTUAL LAN and that you are not allowed to trunk port. This means that there is no support for several VLAN reliable, mapped to a single server at the NAC?

  The restriction of VLAN "single" for Real - IP CASE applies only to the * trust * side. The CASE may be the default gateway for several subnets VLAN / IP on the * rogue * side.

  Configuring addresses VLAN / additional IP on the unreliable side by using the configuration "managed subnet.

  This is mentioned here:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/45/CAs/s_deploy.html#wp1050938

  The clean access server can manage one or more subnets, with its untrusted interface, acting as a gateway for managed subnets. For more information on the setup of managed subnets, see Configuring managed subnets or static routes page 5-26.

  6. can you do role with configurations mapping in the band?

  Yes, you can do it! However, you cannot assign a VLAN as you do in OOB, but you can assign the different level of access based on IP traffic strategies and bandwidth restrictions that you assign the specific role.

  For example, check here for more details:

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/configuration_guide/45/cam/m_users.html#wp1040231

  In a Word, regardless of the use of the band vs OutOfBand:

  -customers are InBand before CAs in CASE detection, authentication, the phases of assessment and remediation of posture.

  The main difference occurs when the user is allowed to access the network and that you run the IB role assignment and OOB but... :

  -in customer traffic keeps on inline flowing to the IB CAs, so you can apply different access policies (ACL) and control of bandwidth depending on the role policies (but you cannot assign a VLAN);

  -in OOB, customer traffic bypasses the CASE once it is authorized: in this case, you can apply different VLAN but (given that the CASE is no longer along the way) you cannot apply ACL and/or ensuring the policy in this case.

  I hope that answers your questions.

  Kind regards

  Federico

  --
  If this answers your question please mark the question as "answered" and write it down, so other users can easily find it.

• NAC SSO vpn: is the CASE real-IP mode supported?

  Hi all

  I tried to setup a CAS like inline real gateway IP to support only enroll via a Cisco ASA running IPsec cisco vpn client.

  CASE and CAM are 4.5.1 running

  I followed the guide online to the letter (except for running in the virtual gateway mode and do the mapping vlan)

  My vpn authentication works on the SAA and Ray is transmitted if the CASE to the ACS server very well.

  I did a tcpdump on the case and cam and saw the package of accounting Radius passed from the ASA to the CAs, and then by the CAS to the CAM, so managing accounts radius 'start' package is sent to the user authenticated on the vpn.

  The problem is that the laptop is trying to access the network does not display the "auto connect" screen of the agent of the CCA, in contrast, agent of the CCA screen the authentication of user request and password details.

  I also following the advice of this link unsuccessfully

  (Known issue for VPN SSO after upgrade to version 4.5)

  http://www.Cisco.com/en/us/docs/security/NAC/appliance/Release_notes/45/45rn.html#wp711526

  So, I am now suspecting whether the CASES can take in charge SSO real-mode gateway IP.

  Dale

  I've implemented in real gw ip mode, but not in 4.5. It has worked well.

  What is the guide that you followed?

  http://www.Cisco.com/en/us/partner/docs/security/NAC/appliance/configuration_guide/45/CAs/s_vpncon.html

• Deployment of Out - of - Band NAC to wireless networks

  I am to evaluate the NAC for my users Wi-wired and wireless apparatus. I've read that the only way to deply to the NAC for the without thread is in-band mode, but it seems that the following link explains that it is possible to deply to the NAC for the in-band mode or out-of-band wireless networks:

  "NAC Appliance can be deployed for wireless LANs in a deployment in the endpoint Strip full-time scanning or out-of-band in a central site for periodic analysis in order to confirm compliance with the posture. The NAC Appliance server performs authentication, the posture and sanitation assessment. The server securely controls the traffic of users authenticated and unauthenticated by the management of traffic of the port/protocol or subnet policies, offering a management policy based bandwidth on share, or bandwidth by user or by using sessions on time and heartbeat checks. (Figure 1) »

  http://www.Cisco.com/en/us/prod/collateral/wireless/ps5678/ps6521/prod_brochure0900aecd80355b2f_ps6128_Products_Brochure.html

  Anyone know if it is possible to use the deployment of out-of-band NAC to wireless networks? If you can point me to documentation it will be appreciated.

  Concerning

  That's right

• NAC 4.1

  Hello friends,

  Pls find the design of the NAC deployment diagram

  Installation of the NAC for the first time, I m bit confused what should I choose Design: it's a business network with access switches, switch, asa firewall, ACS.

  I have a seller multiswitches in my network HP switches and Cisco on the access layer and on the basis, I have a HP 5406, I read the book in the press cisco NAC. It says that u need to choose in-band mode when you have a multi seller going on in your network. So what I thought m is in-band virtual adjacency with real gateway IP or IP layer2 mode.

  But every time I see the document on the cisco Web site that's it for the (real and virtual) network OOB mode I m not able to find any example of configuration for contiguity layer2-band in real ip gateway or virtual gateway.

  Is - my way of thinking is false or please guide me how should I choose.and heading me for the appropriate configuration example.

  Thank you

  Keita,

  Not sure I understand the question completely, but I can say with certainty that the VPN is supported IB with RIP and VGW times. In VGW them VLANS are different on the approved and unapproved side and the worst case, if a switch does not 'just' with the NAC or misbehaves, you can place it in the deployment of true edge to make it work. In short, it is possible

  HTH,

  Faisal

• NAC L2 and L3 Inband simultaneously does not work

  Dear all,

  I have a problem with the simultaneous deployment of L2 and L3 of the NAC.

  I have a CASE that is configured as a real IP gateway, broadband. Previosly, I can have the NAC working on L3 deployment using PBR. I configured the ACB on distribution switch in order to intercept the traffic of untrusted user NAC.

  Now our society tries to add wireless, using WLC, who have the interface vlan configured in CASES not reliable (using the section "managed subnet" on cam). the wireless run perfectly, they able to authenticate to the NAC and able to connect to the network after the authentication of the NAC.

  But now users of L3 cannot reach the unreliable for performing authentication of the NAC. The CASE cannot ping even L3 user which was previosly correct.

  Is there a limitation on Cisco NAC for the deployment of L2 and L3? I read Cisco that a single CASE can be configured to L3 and L2 UNLIMITED so I should work

  TQ
  Imad

  Imad,

  The way you described work is pretty close to the way in which we would have put in place.

  Glad it works for you now!

  My ' salam.

  Faisal

• NAC and change IP address

  Hi all

  We use NAC OOB, L3, gateway real IP with AD - SSO. When users connect to the computer, the PC is supposed to change the IP address after the authentication with the windows user account. But based on security policy, users cannot change the IP address, in order to change the IP address will be failed. There is no work around for this issue? should we change our security policy and allow users to have right to change IP address?

  in this case, what security in GPO to change to give them permission to do "ipconfig / renew" purchase order?

  any suggestions would be much appreciated.

  Thank you

  Alex

  You must install the heel first with admin rights. Then once that the user connects with its own rights (not administrator) and he needs to do anything administratively (like change the IP address), the agent asks the stub to do and it works.

  Click on the link I sent. He has a lot more details :)

  HTH,

  Faisal

• Question of the NAC

  The NAC policy is run on a cisco switch. If a cisco switch not is connected to these cisco switches, NAC policy can be implemented on the switch cisco no?

  You can do that if you perform the mode in-band NAC deployment. You cannot apply the strategies on other cisco switches in tape mode.

  so if NAC is deployed in in-band mode, your answer is Yes.

  If nac is deployed in band mode, your answer is no.

• Assignment of VLAN dynamic RADIUS ACS 5.2 Server with NAC

  We are trying to reduce the number of ssid in our network wireless with assignment of vlan dynamic with the acs. Our problem is that we use Cisco NAC so with assignments of vlan dynamic user will be checked by the NAC. Agent of Cisco sometimes pop up and do nothing to do or give a message cannot locate server. We even got an OOB error. Someone used a VLAN dynamics with the acs and the NAC successfully? The NAC is Out of Band

  Hello

  I supported oob nac and wireless and your efforts to make the dynamic assignment of VLANs will not work because of the way in which him vlan quarantine and access are mapped to this ssid.

  This work in in-band mode, however your design. This WLAN key needs to exist because the Manager sends the snmp trap to move the client from quarantine access.

  Just as a note, I'm sure you are aware is that ISE is the evolution of the acs and the NAC. Basically this your solution to reduce the skates and posturing of the customers.

  Sent by Cisco Support technique iPad App

• VLAN question Unauthentication scaling

  Hi all

  I'm in the process of creating a solution of NAC OOB. The solution is scaling for end-users of 2700. Is there a rule to determine the scale of a vlan authenticated?

  Dirk

  Hello

  You should always 1-1 vlan mapping in deployments of gateway virtual so that the CASE can put traffic customer prior to authentication, on the vlan corresponding to get access ip address for example.

  Only if you use Real-IP gateway, there is no mapping vlan as the CASE acts as a router for the customer of VLAN.

  HTH,

  Tiago

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• ASA5500 - anyconnect VPN not access Web server in DMZ

  I am at a loss. I enclose my config. I can access DMZ from within the network, but cannot access DMZ of VPN.

  Any help would be great.

  Rich

  Also have question access to management 0/0 (192.168.1.1) of the Interior of the E0/1 (192.168.2.0) network

  @richyanni1 ,

  For your VPN - DMZ problem, the following is the most likely cause of your problem:

  nat (inside,dmz) source static obj-dmz obj-dmz destination static obj-vpnpool obj-vpnpool

  You should have in place:

  nat (outside,dmz) source static obj-vpnpool obj-vpnpool static obj-dmz obj-dmz

  That's because VPN clients appear to come from the outside (to some purposes NAT) and the need to be exempt from NAT to access the resources of the DMZ. Management problems, the problem is asymmetric routing. When your packages arrive on the management UI, the ASA will try to send back traffic (starting with the 3-way TCP transfer protocol which will fail) through the inside interface but that won't work because ASA helped him, the source of the acknowledgement of receipt would SAA within the interface IP address, not the address of interface management in which the SYN sent. That's why most of the people have not historically used the management interface to ASA unless you have a real out-of-band network for management. Cisco recently introduced a separate fair management routing table, but you need to switch to 9.5 (1) or later to take advantage of that.

• Virtual gateway Wirelles In-Band NAC Appliance

  Hi, people.

  Knows someone like NAC Wirelles in-band Gateway Virtual Appliance configuration.

  TKS.

  Hello

  Well, it's a pretty simple question and I can say that many people know how to configure NAC to WIreless NVI VG.

  Can you be more clear on exactly what you need?

  ARO

  Tiago

• Default gateway of 8132F Out of Band

  Hello

  I want to check is Gateway default out-of-band 8132F is the same as the default gateway for the switch.

  As I'm now a default gateway of 8132F is not even as a gateway by default out-of-band.

  ---

  out-of-band interface
  IP 192.168.10.210 255.255.255.0 0.0.0.0<-- can="" assign="" another="">
  output
  default IP gateway - 172.16.0.5
  IP route 0.0.0.0 0.0.0.0 172.16.0.5 253
  ---
  Thank you!

  The exit port of the band is at the back of the switch and for out of band management. Page 93 of the user guide shows you where the port is located and has a good description of the port.

  http://Dell.to/1LAfyCM

  If you do not use the port, then there is no need to set the gateway for it.

• Problem of the NAC in the virtual tape gateway VPN SSO

  Hello

  I've implemented a NAC solution for remote users. The unit of CASE mode configured in the gateway enVirtual Strip.

  I followed all the steps listed in http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a008074d641.shtml

  Remote users can connect succeffuly using the cisco vpn software and they can ping the SIN, but not the DNS (the ASA offers IP @ but not the DNS I do not know why).

  When I access the NAS, I can download the NAC Agent but VPN SSO is not executed and the Agent asks me to connect using LOCAL DB.

  Any help please,.

  Kind regards

  Larson,

  For VPN SSO work, you must send the accounting package to the CAs. The CASE can in turn send for the ACS if you need accounting also be done on GBA, but for authentication ONLY work, the accountant must reach the CASE.

  HTH,

  Faisal

• Verification of the Configuration of the NAC/CCA: OOB + virtual gateway (L2)

  Hello

  I'm currently setting up a deployment of NAC from out-of-Bound OOB with virtual gateway. Can someone please check my configs below:

  Central office switch:

  ------------------------------------

  DB OF VLAN:

  ----------------

  !

  VLAN 10

  name VLAN_DEPT1

  !

  VLAN 11

  name VLAN_DEPT2

  !

  VLAN 20

  name VLAN_DEPT3

  !

  VLAN 26

  name VLAN_DEPT4

  !

  VLAN 27

  name VLAN_DEPT5

  !

  VLAN 28

  name VLAN_DEPT6

  !

  VLAN 29

  name VLAN_DEPT7

  !

  VLAN 30

  name VLAN_DEPT8

  !

  VLAN 32

  name VLAN_DEPT9

  !

  VLAN 50

  name VLAN_NetMGT

  !

  VLAN 51

  name VLAN_CAS_MGT

  !

  VLAN 52

  name VLAN_CAM_MGT

  !

  VLAN 210

  name VLAN_DEPT1_Auth

  !

  VLAN 211

  name VLAN_DEPT2_Auth

  !

  VLAN 220

  name VLAN_DEPT3_Auth

  !

  VLAN 226

  name VLAN_DEPT4_Auth

  !

  VLAN 227

  name VLAN_DEPT5_Auth

  !

  VLAN 228

  name VLAN_DEPT6_Auth

  !

  VLAN 229

  name VLAN_DEPT7_Auth

  !

  VLAN 230

  name VLAN_DEPT8_Auth

  !

  VLAN 232

  name VLAN_DEPT9_Auth

  !

  !

  Interface Configs

  --------------------

  interface GigabitEthernet3/41

  Description "Link on eth0 Cisco CAM - PRI"

  switchport access vlan 52

  switchport mode access

  spanning tree portfast

  spanning tree guard root

  No cdp enable

  no ip address

  !

  interface GigabitEthernet3/42

  Description "Link to Cisco CAM - FO eth0"

  switchport access vlan 52

  switchport mode access

  spanning tree portfast

  spanning tree guard root

  No cdp enable

  no ip address

  !

  interface GigabitEthernet3/43

  Description "Trunk to eth1 Cisco CASE - PRI / no reliable network.

  switchport

  switchport trunk encapsulation dot1q

  switchport trunk vlan native 777

  switchport mode trunk

  switchport trunk allowed vlan 210,211,220,226-230 232

  !

  interface GigabitEthernet3/44

  Description "Trunk to eth1 Cisco CASE - FO / no reliable network.

  switchport

  switchport trunk encapsulation dot1q

  switchport trunk vlan native 777

  switchport mode trunk

  switchport trunk allowed vlan 210,211,220,226-230 232

  !

  interface GigabitEthernet3/46

  Description ' box Cisco CASE - PRI eth0 / Trusted Network. "

  switchport

  switchport trunk encapsulation dot1q

  switchport trunk vlan native 700

  switchport mode trunk

  switchport trunk allowed vlan 10,11,20,26-30,32,50-51

  !

  interface GigabitEthernet3/48

  Description ' box Cisco CASE - FO eth0 / Trusted Network. "

  switchport

  switchport trunk encapsulation dot1q

  switchport trunk vlan native 700

  switchport mode trunk

  switchport trunk allowed vlan 10,11,20,26-30,32,50-51

  !

  !

  interface GigabitEthernet1/1

  Description 'Link Trunk DEPT1 access SW'

  switchport

  switchport trunk encapsulation dot1q

  switchport trunk vlan native 700

  switchport mode trunk

  !

  ! - Example of Interface VLAN.

  interface Vlan10

  Description "DEPT1 VLAN.

  IP address x.x.10.1 255.255.255.0

  IP helper-address x.x.50.5

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  no ip route cache

  no ip mroute-cache

  ! - No Interface VLAN for AUTH VLAN 210 -.

  *

  *

  *

  Access switch configuration

  -----------------------------------

  interface GigabitEthernet0/1

  Description 'Link to central office switch Trunk'

  switchport

  switchport trunk encapsulation dot1q

  switchport trunk vlan native 700

  switchport mode trunk

  no ip address

  !

  !

  interface GigabitEthernet0/6

  switchport access vlan 30

  switchport mode access

  spanning tree portfast

  spanning tree guard root

  No cdp enable

  no ip address

  !

  =========================================

  The above configuration is correct?

  Thank you

  The config looks ok, but we recommend the use of false VLAN native to be used on the trunk ports approved and unapproved.

  When you upgrade the client computer on concert 0/6, make sure that moving him vlan 30--> 230.

  Thank you

  Syed