Layer 2 NAC OOB in HA

Can somebody
suggest me switch configurations for layer 2 OOB virtual gateway Haigh availability between distribution and
access layer switch. I use 5 different vlans in 156 subnet ..which are
user vlans and for authentication I used 10.x.x.x series vlans.....
series are 3355 and 3315 as servers and 1 NAC manager in 4.7.2

Thank you for feeding information back to the community to benefit others.
That is the spirit...
PK

Similar Messages

NAC OOB VIRTUAL GW PROBLEM

Hi,
I am trying to setup a NAC OOB Virtual GW Scenario (attached is the visio schematic of the setup):
Switch: 3550 (ios 12.2(46) adv ip serv)
NAC 4130 appliances: v4.1.6 (also tried v4.5)
Switch Configuration of the trunks to the CAS):
- int f0/23 (connected to CAS e0) -> dot1q trunk with native vlan 999 and allowed vlans 199 (mgt vlan of cas) and 10 (hosts access vlan)
- int f0/21 (connected ro CAS e1) -> dot1q trunk with native vlan 998 and allowed vlans 100 (hosts authentication vlan)
- SVIs on switch: 199, 10, 200 (CAM mgt vlan), 99 (dns, dhcp)
The problem I am facing is that the host once connected to a managed port is able to acquire an ip from the access vlan from the dhcp server but is not redirected to the login page. I tried to follow some hints provided in previous posts but none of them worked for me. I configured the following:
- Login Page
- Configured IP based traffic control on the unautheticated role to permit all traffic (also host based to permit https://192.168.199.1 -> cas' ip with trusted dns my dns server 192.168.99.1)
- Managed subnet with unused ip in access vlan (192.168.10.253) and vlan id that of the auth vlan (100)
- vlan mapping between untrusted vlan 100 and trusted vlan 10
- tried to access a resolvable website by my dns from the host (as per the suggestion from a previous post for someone who was facing the same prob)
- also tried to access the cas' login page from the host with vain, eventhough it is accessible from trusted subnets
Note: I followed the configuration guide of both v4.1.6 and v4.5 and with both versions I was facing the same problem.
I would be very thankful for any hints to help me solve this issue.
Questions: When the host is connected to a managed host (assigned to the managed vlan 100) and it is assigned an ip from the a access vlan 10. Shouldn't I be able to access the managed subnet case I configured ip traffic control policy to permit all traffic from untrusted to trusted? also shouldn't I be able to resolve website's ip with "nslookup x.com" since dns traffic is by default configured and also trusted dns server 192.168.99.1 is configured?
Thanks in advance for any help.

It arised to be that the 3550/3560/3750 are not supported for Central Deployment. The problem is solved.
Cisco Catalyst 3550/3560/3750 and NAC Appliance In-Band Central Deployment
For Cisco Clean Access (NAC Appliance) in In-Band Central Deployment mode, when a Cisco Catalyst 3560/3750 series switch is used as a Layer 3 switch and if both ports of the Clean Access Server (CAS) are connected to the same 3560/3750 switch, the minimum switch IOS code required is Cisco IOS release 12.2(25)SEE.
Because caveat CSCdu27506 is not fixed on the Catalyst 3550 series switch, when the Catalyst 3550 is used as a Layer 3 switch, it cannot be used in NAC Appliance In-Band Central Deployment.
For further details, refer to switch IOS caveat CSCdu27506:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCdu27506
See also Switch Support for CAS Virtual Gateway/VLAN Mapping (IB and OOB).
Switch Support for CAS Virtual Gateway/VLAN Mapping (IB and OOB)
Table 6 describes Cisco Catalyst switch model support for the Virtual Gateway VLAN Mapping feature of the Clean Access Server for either in-band (IB) or out-of-band deployments (OOB). This table is intended to clarify CAS network deployment options when connecting the CAS in Virtual Gateway (bridge) mode to the switches listed.
Table 6 Switch Support for CAS Virtual Gateway In-Band/OOB VLAN Mapping Feature
Cisco Catalyst Switch Model Virtual Gateway
Central Deployment
(both interfaces into same switch) Edge Deployment
(each interface into different switch)
6000/6500 Yes Yes
4000/4500 Yes Yes
3750/3560 (L3 switch) Yes with 12.2(25) SEE and higher 1
Yes
3550 (L3 switch) No 1
Yes
3750/3560 (L2 switch) Yes Yes
3550 (L2 switch) Yes Yes
2950/2960 Yes Yes
2900XL No 2
Yes
3500XL Yes Yes
28xx NME Yes with 12.2(25) SEE and higher 1
Yes
1 Due to switch caveat CSCdu27506. See Cisco Catalyst 3550/3560/3750 and NAC Appliance In-Band Central Deployment for details.
2 2900 XL does not support removing VLAN 1 from switch trunks.

NAC - OOB - Virtual IP - users lost connecti

Hi.
So my problem is the follow:
I have i my customer a NAC OOB - Virtual Ip Gateway.
So, we have a many port profiles. Each Port profile witch its own authentication vlan and access vlan, for example:
TI - auth vlan 585 - access vlan 85
ENGINEERING - auth vlan 586 - access vlan 86
And works very very fine.
BUT
There is a common location called PLATFORM (auth vlan 587, access vlan 87) where, to put port profile on each User interface on the switch after 20 minutes or less, the machines that are on this profile (VLANs 587, 87) lose network connectivity, without bounce.
I checked and, some machines for no reason, are changed to vlan authentication without snmp Linkdown and even get stuck in with User certifield device list.
Other machines remain in vlan access, but lose all connectivity to the network without ping gateway and any other device.
Another vlan (for ex: vlan 1) that is not controlled by NAC continues to communicate normally.
I tried to see any logs on the switch but could not see anything abnormal (yet).
Other locations with others port profiles work normally.
The uplinks on this switches and interfaces users dont have any CRC or errors.
Could anyone help me? This is causing problems in my account.

Hi,
I understand then that the clients are not connecting through local or SSO mode, is that correct?
I would suggest 3 things so far:
1. Check the logs on the switches where the CAS's are connected, I had a similar problem where CAS would stop responding and the switches would complain about vlan mismatch or mac flapping, if you notice errors on the switches verify that you have:
* Vlan mapping enabled correctly
* Different native VLAN on the switch interface for trusted and untrusted CAS ethx.
* The correct vlans configured on each port: for untrusted just the authentication (layer 2) vlans, for trusted interface the access vlan (20) and the management vlan.
2. Enable the management vlan tag on the trusted interface of the CAS and use your CAS management vlan.
3. On the CAM go to the Clean access server section, manage one of your CAS's, the first window will show the services currently running on the CAS, verify if the SSO service is running, if it's not running, verify the configuration. If it's not allowing you to enable it, verify the time settings on your devices, the AD user and all the other settings needed for this to work.
Hope this helps,
Regards,

Urgent-NAC OOB VG Deplyment

hi all,
Iam in the middle of design of NAC OOB Virtual Gateway.
I have the following doubts regading the placement of NAC Server to my existing Network
I have two Core ( redundancy -HSRP ) running VTP & 25 Edge Switches ( VTP Client )
According to CISCO , we can place NAC Server either in the Core or distribution Switches only , not on the edge switches, in OOB Virtual Gateway deployment.
But currently my existing core switches is not having copper connectivity, customer don't want to invest on core switches.
so I have to forcefully move the NAC server to one of the EDge Switches with both interfaces ( trusted & untrusted ) connected to same Edge switch, but CISCO is not recommending to do so in NAC OOB VG Deployment.
I need to know why we cannot place NAC server at one of the Edge Switches. ( NAC OOB VG Deployment ) , what are the issues behind that ?
One more thing is that , as my Network is running VTP , what are the things to be consider during the design of NAC OOB VG Deplyment.
Iam attaching the Network Diagram, Please go through that.
Expecting your valuable suggestions.
Regards
Dileep

Dileep,
You can put them on the edges, but you have to make sure you extend all the VLANs necessary to that edge. It's just bad design, but I don't see why it won't work.
Unfortunately you don't have enough details in the map you provided to get a more detailed answer :-)
HTH,
Faisal

NAC OOB and 6500 in Virtual Switch Mode

Is there any issue or special care to implement NAC OOB in Central Deploy, VGW, using AD SSO for wired clients where the Core Switch is a pair of 6500 in Virtual Switch Mode?
The customer uses Radius IAS for authentication. How does it fit with the AD SSO?

Hi Bruce,
I am afraid there are some arguments missing in your db command.
To manually add the OID of Cat4507R+E to CAM's database here is the procedure to do this.
[root@cca-3140-cam ~]# psql -h localhost -U postgres controlsmartdb -c "INSERT INTO supported_switch VALUES ('1.3.6.1.4.1.9.1.1286', '4', 'Cisco Catalyst 4507 R+E')" INSERT 0 1
psql: warning: extra command-line argument "INSERT" ignored
psql: warning: extra command-line argument "0" ignored
psql: warning: extra command-line argument "1" ignored
INSERT 0 1
Then to make sure it is there:
[root@cca-3140-cam ~]# psql -h localhost -U postgres controlsmartdb -c "SELECT * FROM supported_switch" | grep 1286
The output should be:
1.3.6.1.4.1.9.1.1286 | 4 | Cisco Catalyst 4507 R+E
Restart perfigo service on NAC Manager and try to manage the switch using the model used by the above command.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

NAC OOB Logoff feature workaround ?

Hi,
We have a NAC OOB, Real-Ip Layer2 setup and the new option "Logoff Clean Access Agent users from network on their machine logoff or shutdown" does not apply when using OOB mode (which is annoying). Anybody found a way to make sure that when a users logs off from his PC he's automatically put back to the authentication VLAN ? We thought of maybe put a program in Windows XP logoff script that would disable/enable the NIC card but it seems a bit tricky...
I'm sure I'm not the only one who's trying to find a solution for this. Hopefully Cisco will support this feature right from the clean access agent in a future release...
Thanks.
Dominic

for now we are waiting for the feature to become available from Cisco in Q2 or Q3 of 2007.
And yes, we are using SSO in a Windows XP - Windows 2003 environment.
Dominic

NAC OOB Configuration

Hi!
I'm implementing an NAC oob solution. tTe CAS and CAM are in the Data-center on an remote network, and i need to control the vlan's that my users access on my remote sites.
How do i make them authenticate on the remote CAS? (the Cas is on an remote network)
TKX
Miguel

Hi,
Well, it looks like you are starting now, so I would advise to get in touch with the OOB concept and guidelines:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cam/m_oob.html.
You have L2/L3 mode.
You have OOB/InB mode.
You have Real-Ip/Virtual gateway mode.
You have 2 main VLANs for the clients: authentication (untrusted) and access (trusted) vlans.
The goal is to make the client fall into the auth vlan prior to login, and the traffic flow through the CAS so that the CAS can permit/deny the client from passing traffic.
You have also, nice chalk-talks where you can see VODs explaining the steps for configuring several features/deployments:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/prod_presentation0900aecd80549168.html.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

NAC-OOB L2- Authentication Login page dosn't appear!

Hi All,
We have 2 NAC managers and 2 NAC servers. We have a failover solution. Our deployment is OOB Layer 2 Central Virtual Gateway. We have successfully added NAS into NAM and we did the required configuration in NAM like configuring VLAN mapping (from the untrusted vlan 913 to the trusted vlan 910), adding managed subnet, switch profile, port profile, adding switches (cisco 3560) to NAM, configuring user roles, local users and also user login page.
Then we have tested it by connecting PC to the controlled port on the switch.
The configuration of the controlled port was on VLAN 910 and after connecting the PC, it's converted to VLAN 913 then we successfully got an IP from the dhcp which is configured on the switch but the authentication login page didn't appear! and also, when we disconnect the PC from that port, the configuration isn't converted from vlan 913 to vlan 910 so we have to change it manually everytime to do our tests.
What should we do to let the login page appear and also automatically let NAM change the port configuration after disconnecting the PC?
Thanks in advance.

hi faisal,
the KTPass command is as following:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:Arial;
mso-bidi-theme-font:minor-bidi;}
C:\Program Files\Support Tools>ktpass.exe -princ test/[email protected] -mapuser test -pass test123 -out c:\mai.keytab -ptype KRB5_NT_PRINCIPAL +Desonly
and the attached log file.
Thanks

NAC OOB VRF L3 - PC sleeps instead of shutdown - Client comms issue.

I was wondering if anyone had come across this issue and had figured out a method to prevent the situation whereby when a user leaves the office for the evening, they DONT shutdown there PC, after a few hours the PC goes to sleep causing a toggle of the switchport from trusted to untrusted role.
As we know in the OOB L3 deployment as soon as the port is toggled to the untrusted role this is assigned to the untrusted L3 VRF IP addressing e.g 192.168.1.X. when the user comes in the following day he activates his PC again and the client cannot gain access to the network due to it still having the trusted IP Address of the network 10.1.1.X and being allocated to the untrusted VRF. The bounce option of the port profile cannot be set due to the user having the PC connected to the network via an IPT phone! Has anyone overcome this situation ? Your assistance is appriciated.

Well I dont think both layer 2 and layer 3 are going to work. When you add your CAS to the Nac manager it will ask the type of deployment. I am using layer 3 OOB. You also do not need a trunk port with this type of deployment. I would make the untrusted network a SVI Vlan off your core and then lock things down via an ACL. You will need to allow the 8906, 8906 TCP,UDP & 8910 TCP. You will also need to allow all of the MS ports DHCP, DNS. Here is an example of the ACL I use.
    10 permit icmp any any echo-reply
    15 permit icmp any 10.20.1.0 0.0.0.255
    20 permit udp any any eq bootpc
    30 permit udp any any eq bootps
    40 permit udp any any eq domain
    50 permit tcp any 10.20.1.0 0.0.0.255 range 49152 65535
    60 permit udp any 10.20.1.0 0.0.0.255 range 49152 65535
    70 permit udp any 10.20.1.0 0.0.0.255 eq 389
    80 permit tcp any any eq 8905 (116 matches)
    90 permit udp any any eq 8905 (370 matches)
    100 permit udp any any eq 8906
    110 permit tcp any 10.20.1.0 0.0.0.255 eq 389
    120 permit tcp any any eq 8910
    130 permit tcp any host 10.20.1.1 eq 443
    140 permit tcp any host 10.20.1.1 eq www
    150 permit tcp any 10.20.1.0 0.0.0.255 eq 88
    160 permit tcp any 10.20.1.0 0.0.0.255 range 135 139
    170 permit tcp any 10.20.1.0 0.0.0.255 range 1025 1026
    180 permit tcp any 10.20.1.0 0.0.0.255 eq 3268
    190 permit tcp any 10.20.1.0 0.0.0.255 eq 445
    200 permit udp any 10.20.1.0 0.0.0.255 range 135 netbios-ss
    999 deny ip any any

NAC, OOB wireless and Active directory

Hello.
Here we need to set up Network Access with OOB wireless and authentication via Active Directory. I have followed this guide but still can't get it work.
http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080a138cc.shtml
In my scenario:
CAM NAC: 192.168.7.100
CAS NAC: 192.168.9.9
WLC 5508: 192.169.9.2
AD and DHCP servers: 192.168.7.2 and 192.168.8.2
APs and clients range: 192.168.9.0/23
when i Check "Radius Server Overwrite interface" and select NAT state: SNMP NAC on the following images....
I try to navegate and I get the Login default page that I already configured asking me for credentials, I type them but it get stucks there. I have already configured everything showed on the guide posted above. Do I need to do something else that is not explicitly explained in the guide?
Thanks in advance.

Sarayanan
I just tried without "Radius Server Overwrite interface" checked and got the same results. WLAN is mapped with interface managment
AP group is the default one.
Here are the CAM logs
On the NPS windows server 2008 cant see any log about this connection. Please give me some advices.
Thanks in advance.

WISM and NAC OOB/ Client in a different WLC problem

Guys,
I am using two WiSM modules in 6513 Chassi.
We have 3 SSID configured but on each WLC are using APGroups making a Layer 3 roaming.
Well, Everything is work out fine and we have hundreds of the connections per day but each day appear two or three clients that still on Quarantine mode and the WLC does not change Auth_vlan to Access_Vlan.
NAC appear that client as ONLINE on WLC 3 but that client isn't there, he is on WLC 2 in Quarantine mode.
anyone know can help me?
thanks a lot

I think the jndi service can be accessed froma remote m/c, you can initialize the context with the appropriate paramters, so the lookups on the topic and connection factories and continue with your work.

NAC.OOB.L2.Real IP GW.dhcp-relay issue.

Hello.
I have CAM (manager) which is configured as L2 OOB real-ip gateway. central deployment.
ethernet 0 (trusted) is L3. (ip add x.x.x.x)
ethernet 1 (untrusted) is .1q and several authentication vlans (a,b,c,d) are connected to it.
of cause managed subnets are configured for auth vlans on eth1.
Manager is configured as dhcp-relay.
Is it ok that manager changes dhcp packets to the dhcp server so that it's ethernet 0 ip address (x.x.x.x) becomes the source address of the requests to the dhcp server?
how can dhcp server recognize auth vlan a from auth vlan b if all packets have the single source (x.x.x.x)???
Where could be my mistake?
Regards

Hello varnavsky!
You have to configure vlan mapping (at the CAM) for all authentication vlan! After the authentication and posture validation, the NAC client won't give a new IP address, so the client has to have an IP address from the proper access vlan. When you configure these vlan mappings CAS always acquire an IP address from the proper range.
By(e) Miki

NAC OOB Real IP GW Question

Is it normal for the OOB Online users report to contain the Authentication VLAN IP address? This is what is happening in my environment, OOB Real IP GW with user role VLAN's assigned by AD SSO. It would be nice if this displayed the IP address of the user after it was placed in their end VLAN.

Use the following Out-of-Band Enhancements (Release Notes for Cisco NAC Appliance (Cisco Clean Access), Version 4.1(3)) for your assitance.
http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/413/413rn.html#wp299734

NAC OOB problem - moving users between ports

Hi,
I have a problem with an OOB deployment I am currently working on: when I move an authenticated OOB client from one switch to another, it remains stuck in the auth VLAN. It seems that NAC doesn't detect the new port correctly.
This is what I did to replicate the issue, in detail:
1) A computer is connected to port 'a' on switch 'A' (A[a]). The port is automatically changed to auth VLAN and authentication and posture assessment are performed.
2) The computer passes both, and the port is changed back to the designated Access VLAN. OOB user appears in the Online Users list, and the computer is added to the Discovered (Wired) Clients list. All the detailed information on both pages is correct.
3) The computer is disconnected. OOB user is removed from the Online Users list, but the computer remains in the Discovered Clients list.
4) The computer is connected to port 'b' on switch 'B' (B[b]). It is automatically changed to auth VLAN and authentication and posture assessment passes successfully one more time. However, the information in the Discovered Clients list is not updated and, moreover, OOB user appears once again in the Online Users list - but the specified location is port A[a]!
The end result is taht the computer remains stuck in the Auth VLAN and NAC Agent Authentication dialogue keeps popping out.
I tried the reverse scenario (port B[b] to port A[a]) after manually clearing all user and client information, and the result was pretty much the same...
Thanks,
Boris

Faisal,
The configuration includes the following lines (on both switches I used for access):
snmp-server community *** RW
snmp-server community *** RO
snmp-server trap-source Vlan2 (management subnet)
snmp-server location 10.0.0.101 (NAM IP address)
snmp-server enable traps snmp linkdown linkup
snmp-server enable traps mac-notification change move threshold
snmp-server host 10.0.0.101 version 2c cisco mac-notification snmp
Also, NAC added the following line on monitored interfaces:
snmp trap mac-notification change added
Is this all that is required to send MAC-change and MAC-move traps?
I captured SNMP traps with a 'tcpdump' on the NAM and I can confirm it receives traps from both switches, with correct source IP addresses. I will try to look into a "raw" dump to see the exact traps it received...
Regards,
Boris

NAC OOB L2 VG Managed Subnet

I have configured OOB Virtual Gateway. However, the CAS fail to detected and redirect to the login web page.
sometime i change the managed subnet, I work...
I wonder what exact IP address should be typed into the managed subnet?
Suppose I have 10 trust VLANs (10,11,12,13 ...) , and i create related 10 untrusted VLAN (20,21,22,23...)
IP address for VLAN 10: 192.168.10.0/24
IP address for VLAN 11: 192.168.11.0/24
IP address for VLAN 12: 192.168.12.0/24
IP address for VLAN 13: 192.168.10.0/24
I have tried 4.1.x version of CAM/CAS, the page allowed us to input subnet address.
However, in 4.5.x or above, we must input host ip address. Now i upgraded to 4.7.2 versions, what IP address and VLAN should i type into this page?
192.168.10.254/24 VLAN20
192.168.11.254/24 VLAN21
192.168.12.254/24 VLAN22
192.168.13.254/24 VLAN23
or
192.168.10.254/24 VLAN10
192.168.11.254/24 VLAN11
192.168.12.254/24 VLAN12
192.168.13.254/24 VLAN13
also, I wanna to ask the Network page of CAS. The Set management VLAN ID of untrust interface should set to "0" ,"left it blank" or "one of trust VLAN"??
I'm green hand in NAC...hope someone guide. Many Thanks

Successful to get IP NOW... coz some VTP set to transparent and can't learn all VLAN.
Even that... some issues i face.. Since User Flat network is big enough and cover thousand of switches. I find some characteristic ..
The big flat network is using "3750 stack" as core switch. The version of IOS is 12.2(25). I did check with doc.
Extracted as below:
Stacked Cisco Catalyst 3750 Switches and NAC Appliance Out-of-Band Deployment
For Cisco Clean Access (NAC Appliance) customers with OOB deployments running stacked Cisco Catalyst 3750 switches with Cisco IOS 12.2(25) SEC2 or lower, SNMP mac-notifications can fail, and SNMP does not report MAC addresses to the OOB Clean Access Manager and Server.
So.................... my Question is:
Although this Switches might fail to snmp notification to CAS/CAM, all other switches connected to this 3750 would fail to report snmp notification also???
My case seems like all switches connected away from the switch connected to CAS/CAM is success performing login and authentication by CAS, However, all switches connected to this core 3750 fail to perform the login ..even no login page find..
SW1 --- 3750 -- SW2 --- SW3 --CAS & CAM
SW2 and SW3 could success performing CAS login.
SW1 fail to get login page and fail to do authentication. But could get DHCP and stuck in untrust VLAN.

Layer 2 NAC OOB in HA

Similar Messages

Maybe you are looking for