NAC 4.7.2 (OOB VGW)) MAC certificate validation slow

Question

We have been seeing some odd behavior with certificate validation with MAC OSx device running the installed agent.
When a user enters their userid and password  they sometimes will get a SSL cert error. If the user clicks on login multiple times they will eventually certify and join the trusted network.
I did a packet capture of a machine that was experiencing the problem.
The packet capture showed the MAC making a DNS query for the Verisign server's IP address and the DNS server returns the correct answer. The expected connection to the Verisign server never occurs. (The ssl cert error on the MAC shows up about now.)
If login is clicked (several times) and you go through the cycle again eventually the connection to the Verisign server is established the certificate is validated and user is placed into the trusted vlan.
Has anybody else experienced this? Any ideas?

Answer 1

Faisal,
I reviewed my work including where I performed my captures. The capture I did initially was between the CAS and the outside world - our routing core.
I decided to span a port a MAC was connected to and performed another capture.
Lo and behold the MAC was actually trying to connect to the Verisign server based on IP address of the forward DNS lookup send originally from the MAC.
I thought about the process and I believe that NAC has to do a reverse lookup on the IP address so that it can compare the server name against host filter I built to allow the traffic.
The filter was based on the forward lookup so it was something like "ends with crl.verisign.com"
When I did a reverse lookup I discovered most of the servers returned something like "crl.indv10.verisign.com" which of course did not match the filter I had created. Traffic blocked.
I changed the filter to just "ends with verisign.com" and it worked 95% of the time.
Why only 95%?
One of the servers had an IP address that was outside the 199.x.x.172 pattern most of them use and it did not return a name when the reverse lookup occurred. I finally ended up adding that as IP address as a filter.
No problems now.
Later!
Bob