NAC for wireless layer 3 oob

Hi,
Anyone implemented nac for wireless layer 3 oob? This is using nac appliance not ise.
What I did is to configure wlc as per layer 2 oob setup. Configure svi 669 (authentication/quarantine vlan) on switches that’s with the wism. Pbr all vlan 669 traffic to test cas untrusted interface.
Problem now I’m not able to get an ip from dhcp after associating. DHCP works when tested on wired. Is there any additional config to be done on WLC or am i doing it right??
The test cas/cam are ugraded to ver 4.8.2.
Regards
Joachim

Everyone can do a mistake and it seems I did a big one :-)
l3 wireless OOB was not supported until last version :
§Wireless L3 OOB RIP has been introduced in 4.8.2.
§In order to support wireless in L3 OOB RIP deployment – DHCP release and renew values were propagated from CAS to the client so that client can perform IP refresh.
§The configuration of WLC and AP’s needs to be done like in Wireless L2 OOB VGW deployments.
§There are no ports in WLC hence Port profile is not required
§WLC allows only two VLAN’s namely Quarantine (Auth) and Access VLAN’s. Hence the support for User role Vlans is not there in Wireless deployments.
§iPhone/iPad support is also not present. Reason being IP address cannot be refreshed in iPhone/iPad due to lack of support for Java Applet/ActiveX.
§The authentication trap control needs to be checked in order for the WLC to send 599.0.4 trap.

Similar Messages

NAC Out-of-Band Deployment for wireless networks

I am evaluating the NAC appliance for my wired and wireless users. I have read that the only way to deply NAC for wireless is in-band mode but it looks like the following link says that it is possible to deply NAC for wireless networks in-band or out-of-band mode:
"NAC Appliance can be deployed for WLANs as an in-band deployment for full-time endpoint scanning or out-of-band within a central site for periodic scanning to confirm posture compliance. The NAC Appliance server performs authentication, posture assessment, and remediation. The server securely controls authenticated and unauthenticated user traffic by managing traffic policies based on protocol/port or subnet, providing bandwidth policy management based on shared, or per-user bandwidth, or using time-based sessions and heartbeat controls. (Figure 1)"
http://www.cisco.com/en/US/prod/collateral/wireless/ps5678/ps6521/prod_brochure0900aecd80355b2f_ps6128_Products_Brochure.html
Does anyone know if it is possible to use NAC out-of-band deployment for wireless networks? If you can point me to some documentation it will be appreciated.
Regards

Thanks Robert.
In my case I am planning to deploy a central NAC appliance at the main office to control some branch offices and local wired users at the main office. The NAC appliance will operate in out-of-band mode. But for wireless users at the main office I will need an aditional NAC appliance operating in in-band mode, is this correct?
Regards

Cisco NAC Layer 3 OOB Support for Wireless

We are currently using NAC 4.7.2 and I am curious if Layer 3 OOB for Wireless users is on the roadmap. We have a WISM and 5500 controllers. Thanks.

Hello,
I know it's being worked on, but isn't in the near releases coming out soon. 4.8 is expected very soon and it's not in that release.
So long story short, don't know, but it will be there eventually.
HTH,
Faisal

DMZ Anchor WLC setup for Wireless Guest Access

I have the following setup.
A DMZ WLC 4402 connected to firewall DMZ interface in 10.10.73.0/24 network.
An Inside WLC 2106 connected to firewall Inside interface in 10.10.71.0/24 network.
Both WLCs are running the same 4.2.176 code.
DMZ WLC is anchor to itself and Inside WLC select the DMZ WLC as the anchor point.
I have setup EoIP between DMZ and Inside WLCs successfully with both the control and data path both show as UP status. >> "show mobility anchor"
The main issue: Clients cannot obtain IP addresses after connected to Guest SSID.
1. Inside WLC, the guest WLAN ingress is 802.11b/g radio and egress port is set to management interface (EoIP) of type WLAN.
What is the DMZ WLC setting? Is the ingress set to "802.11b/g" which does not make sense because the ingress is EoIP from Inside WLC?
Or I still set as 802.11b/g? Same config as Inside WLC? I read from other threads suggested by Terry that the config must be the same for both WLCs.
In the Inside WLC, I saw alot of pdu encapsulation errors for broadcast packets which is ffff.ffff.ffff xxxx which I think is the DHCP request from the connected Wireless clients not making through the EoIP tunnel. I have set static ip for the Wireless client but the packets cannot route through the EoIP tunnel to the far end.
2. DHCP server is provided by DMZ WLC with the scope 10.10.76.0/24. In the Inside WLC, which DHCP server IP adddress to set to? DMZ WLC mgmt ip address? DMZ WLC, the DHCP server is also set to DMZ WLC mgmt ip?
3. Layer 2 authentication. I read that DMZ WLC is supposed to be the DHCP server, Layer 2 or 3 authentication for Wireless Clients. However, it seems like Inside WLC is required to configure the Layer 2 authentication parameters and the DMZ WLC is set to providing the DHCP service?
4. Lastly, anyone has done DMZ WLC sending the Wireless clients traffic to Bluecoat proxy server before hitting the Internet?
Thanks.

One of the biggest things is to make sure the wlan is configured exactly the same. The DMZ WLC ingress is the management and also is the egress port. You can create a dynamic interface on the DMZ WLC, but this way makes thing easier. The DMZ WLC should provide the dhcp, so the dhcp scope of course will be on the same subnet as the management of the DMZ WLC. The DHCP Server will be the ip address of the management interface of the DMZ WLC. The authentication also has to be configured exactly the same on the inside wlc and the DMZ wlc. Since you are pushing clients through the tunnel to the DMZ WLC, that is where clients will need to get their ip address, since that DMZ WLC has a network interface to the guest network. I haven't had luck when a proxy is involved, but I know there was a post a while ago on how to setup the proxy to allow the wlc to bypass the users initial dns resolution.

NAC 4.7.2 OOB SNMP issues

Hello,
I am setting up a NAC CAM and CAS 4.7.2 OOB setup in a test environment (NAC failover for CAM and CAS), and I am seeing some strange SNMP issues. I am testing with a 3750 switch (12.2(53)SE1) using SNMP v2 and v3 since v3 and accessing the switch port configuration in the NAC manager is extremely slow. I click OOB Management -> devices -> switch XXX and it takes several minutes for the port listing to display. Then sometimes it comes up quickly but a 'show debug snmp' on the switch shows that it isn't polling the switch so it apparently starts pulling the ports page from cache, but I can see now logic in how it does this.
Q1) When and why does the ports page pull cached info?
Q2) Why is SNMP queries operating so slowly with NAC 4.7.2 OOB?
Here is my test switch/NAC SNMP config (with pseudo names and fake passwords):
snmp-server community switch_read ro (matches OOB Management -> Profiles -> Device -> SNMP Read v2 settings)
snmp-server view v1default iso included
snmp-server user switch_write switch_group v3 auth md5 <my-password> (matches OOB Management -> Profiles -> Device -> SNMP Write v3 settings)
snmp-server group switch_group v3 auth read v1default write v1default
snmp-server user cam_notify cam_group v3 auth md5 <my-password>
snmp-server host 10.200.11.100 traps version 3 auth cam_notify mac-notification snmp (matches OOB Management -> Profiles -> SNMP Receiver v3 settings)
snmp-server group cam_group v3 auth read v1default write v1default notify v1default
What is wrong with my setup? Any help is appreciated.

Did anyone ever find a solution to this issue? I'm having the same problem.... it takes minutes to open the ports on a switch in the CAM. It shouldn't take minutes to manage ports for each switch, it should take less than 10 seconds...

Does Cisco NAC support Wireless LAN?

Hi There
I know Cisco NAC supports Wireless LAN. I have deployed this myself with various brands of Autonomous APs. These works fine only in in-band mode, not in out-of-band mode.
However, Cisco did mentioned for Cisco AP, with Cisco NAC and Cisco switches, out-of-band is supported. I tried this today, and it's either Cisco is wrong, which is highly unlikely, or I did not configure either the NAC portion or the Cisco AP correctly, which is most likely? I wonder where did I go wrong? Please somebody, advice me on this?
Regards,
Ram
+6012-2918870

Hi Ramraj,
You can do out-of-band with Wireless deployments now, however you must have a Wireless Lan Controller managing your APs. You cannot do it with standalone APs.
The guide below goes through most of the configuration:
http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080a138cc.shtml
Thanks,
Nate

Can not connect All in one 209b to new router for wireless printing....

Have an HP laptop and All in one priner 209b. All was working fine, wired and wireless printing. Then we had to upgrade our ATT Uverse router. Everything works...even wireless laptop and printer when connected to laptop. However, can't get printer to printer wireless since it has the old router info. I used the disk but when it asks to you to pick the printer, I choose the printer but it says printer now found ??? what ???? and this is with the cable connected. I do not have the wizard on the touch screen but I did reset to factory settings hoping it would load new router info but it does not. How do you manually enter router into for wireless printing. Is it best to delete the printer and reinstall as new...wired and then wireless ???
I am about to call an outsite company and pay the outrageous charge as the help on HP is not working. Thanks

Try this utility:
http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02114394&cc=us&dlc=en&jumpid=reg_r1002_usen&lc=...
007OHMSS
I was a support engineer for HP.
If the advice resolved the situation, please mark it as a solution. Thank you.

I have an IMAC that runs OS 10.6.7. I use Netgear for wireless. My computer keeps losing the network, so I can't use wireless.

I have an IMAC that runs OX 10.6.7. I use NEtgear for wireless. I have a laptop and Ipod that I use on the wireless. Recently, my desktop computer shows that it is searching for the wireless system (on the router). I contacted Netgear. They talked me into buying another router and their technical contract. Nothing is working. I can plug my 5200 modem directly up to my desktop , and the network is fine, but the wireless, of course, is not plugged in. When I go to connect the wireless, it doesn't work. This is not a computer program per se, nor is it a router program because sometimes it will work. It seems to me that the computer and router are not working together to hold the settings.
I have attempted to download the latest software for my computer, i.e., Imac graphics fireware. Each time I try, it says that the extensions are not valid for my computer.
Any suggestions?
Thanks, Vicki

Imac graphics fireware.
Did you mean to say firmware? You should only install firmware updates when offered to you via Software Update; other than that, whatever is offered is not appropriate for your model.
As for your Netgear router - I have a Netgear and set it up manually on their web interface setup site (the address should be in your manual). Did you call your ISP so they will recognize that there is a router involved? Sometimes my iMac also does not want to communicate with the router; however, my Macbook and printer have no problem. I solved the problem by connecting things this way:
cable from wall to modem > cable from modem to router > cable from router to iMac. The other things are wireless.

How to set up Airport Extreme with Charter ARRIS Modem TM902A for the first time for WIRELESS.

How to set up Airport Extreme with Charter ARRIS Modem TM902A for the first time for WIRELESS.
When Charter Tech goes to your site, have them connect the modem up, but do not connect the modem to your iMAC or MacBook Pro. What you want to do is connect the Airport Extreme to the iMac or MacBook Pro first with the Ethernet Cable. You have to do this to configure via Airport Utility to set up the Base Station Name & Base Station Password.
You will then create/configure a Wireless Network, create your Wireless Password that will be entered on each of your Devices, example, Apple Tv, your iPhone, etc., you want to allow access to your Wireless Network you are creating.
Wireless Security will be -> WPA/WPA2 personal or just WPA2
Enter the Wireless Password you want
Verify the Wireless Password (enter it again)
After it is created you will see it on the Airport Utility window with the name you created for it and to the left, will be a Dot (circle that will be yellow).
Next you then want to unplug the power to the Airport Extreme, and then take the end of the Ethernet cable you unplugged from the iMac or Lap top MacBook Pro and connect it to the back of the Modem.
Next unplug the power cord from the modem and wait about 5 minutes, then plug the power back into the Arris Modem and wait until all lights come back on the modem wait
about 5 minutes, then plug the power cord back to the Airport Extreme and you will see it the light blinking yellow. Wait about 5 to 10 minutes, during this time Restart you IMAC or MacBook Pro, and once it is back up click on the Airport Utility and you should see on the Airport Utility screen.
For INTERNET to the left the light should be green and you should see the Airport Extreme also appear and the light to the left on the screen should also be green. If they are, you then should be able to click on the Wireless Symbol on top of bar of the screen and click to select the Wireless Network Name you created.
If you Do Not See the light (Icon) next to INTERNET turn Green, or if you see the Internet Light Green, but the Light (Icon) next to the Airport Extreme is yellow, unplug the power again to the modem and unplug the power again to the Airport extreme and wait about 15 minutes or up to 30 minutes. Then plug the power cord back to the modem wait till all the lights light up then, plug the power cord back into the Airport Extreme and Restart your iMAC or MacBook Pro.
The Airport Extreme light should change from yellow to green. Open up the Airport Utility to see what the indicators are showing they should both be green. Again select Wireless network you created under the Wireless Icon on the top right of the screen. Open Safari and see if you are able to Route to a web page or the apple site should appear.
WHAT TO DO IF YOUR AIRPORT EXTREME WAS PREVIOUSLY SET UP FOR USE WITH ANOTHER CARRIERS ROUTER OR MODEM.
NOTE: If you already had your Airport Extreme connected for example, I previously had ATT Uverse and the Airport Extreme was connected to the Wireless Router Model 3801HGV, I disabled the Uverse Wireless and used the Airport Extreme for the Wireless signal in bridge mode, as the Airport extreme Signal is much stronger than the Uverse router, and I was able to obtain a Wireless signal with the Airport Extreme way much better with no signal loss which was very very frustrating with the Uverse router.
Anyhow if you had it hooked up like this, now that you will be using it with the Charter ARRIS Modem TM902A, you will need to reset the Airport Extreme to clear out the old data it has in memory, with the previous set up otherwise it will not work. Trust me I spent 6 hours trying to make it work reading all Apple Support Community questions and answers relating to this type issue/problem others have been having trying to get their set up working. I tried all the tips, and I finally decided just to see if by chance I would be able to connect with someone with Charter Tech support who might be familiar with Apple to be able to assist me and by luck I did. He told me why it was not working and was all due the previous configuration with the ATT Uverse router was still in memory with the Airport Extreme. Finally it was 10:30 PM when I decided to call Charter Tech Support and I had been working on this since 3:00 pm pacific. I did not call them earlier as all the post I read said they never received any good help from Charter. After calling them I finished up by 11:00 PM and was able to finally connect Apple Tv, iMac, iPhones and Macbook Pro. We love our Apple Product and Happy all is connected with the new
Internet Provider Charter. I must say the speed is way way much better than it ever was with AT&T Uverse.
THIS IS WHAT YOU WILL NEED TO DO:
First you will need to unplug the Airport Extreme, then by taking the tip of a pen or paper clip end you need to push the reset button on the back of the Airport Extreme and hold it
down and at the same time plug the power cord back into the Airport Extreme count to 5 or 10 then release the reset button. Then once he light in front of the Airport Extreme stops blinking you need to plug the Ethernet cable from the Airport Extreme to your iMAC or Macbook Pro, and restart which ever one you have, then open the Airport Utility once it is back up. If you see airport extreme pop up with the old network name or it shows and yellow triangle click on the Airport Extreme ICON it will not let you configure it but will ask if you want to get rid of it or remove and just do it. Then Again restart your iMAC or MacBook Pro, open up Airport Utility again, and on the top left you should see under “Other Airport Base Stations” the MAC ID for the Airport Extreme.
You will then create/configure a Wireless Network, create your Wireless Password that will be entered on each of your Devices, example, Apple TV, your iPhone, etc., you want to allow access to your Wireless Network you are creating.
Wireless Security will be -> WPA/WPA2 personal or just WPA2
Enter the Wireless Password you want
Verify the Wireless Password (enter it again)
After it is created you will see it on the Airport Utility window with the name you created for it and to the left, will be a Dot (circle that will be yellow).
Next you then want to unplug the power to the Airport Extreme, and then take the end of the Ethernet cable you unplugged from the iMac or Lap top MacBook Pro and connect it to the back of the Modem.
Next unplug the power cord from the modem and wait about 5 minutes, then plug the power back into the Arris Modem and wait until all lights come back on the modem wait
about 5 minutes, then plug the power cord back to the Airport Extreme and you will see it the light blinking yellow. Wait about 5 to 10 minutes, during this time Restart you IMAC or MacBook Pro, and once it is back up click on the Airport Utility and you should see on the Airport Utility screen.
For INTERNET to the left the light should be green and you should see the Airport Extreme also appear and the light to the left on the screen should also be green. If they are, you then should be able to click on the Wireless Symbol on top of bar of the screen and click to select the Wireless Network Name you created.
If you Do Not See the light (Icon) next to INTERNET turn Green, or if you see the Internet Light Green, but the Light (Icon) next to the Airport Extreme is yellow, unplug the power again to the modem and unplug the power again to the Airport extreme and wait about 15 minutes or up to 30 minutes. Then plug the power cord back to the modem wait till all the lights light up then, plug the power cord back into the Airport Extreme and Restart your iMAC or MacBook Pro.
The Airport Extreme light should change from yellow to green. Open up the Airport Utility to see what the indicators are showing they should both be green. Again select Wireless network you created under the Wireless Icon on the top right of the screen. Open Safari and see if you are able to Route to a web page or the apple site should appear.

I just got a Charter Modem. Model TM822. While I was moving, my Airport Extreme was still at my old place.
I have a Linksys WRT320N I used for the initial Charter setup.
I can get my Airport to work here, but the Internet light on the Modem flashes Yellow.
Hasn't caused any issues so far but one thing I did notice.
On the Linksys there were 3 DNS servers listed.
The Airport Extreme only lists 2 and i don't see where I could add another, only change whats already there.
I tried everything above, but light on modem still flashes yellow.
I have the technicians cell phone. Told me "that shouldn't be" and gave the same advice listed above.
I'll break down and call Charter one day, see if it's on their end. NSA tracking may need a reset LMAO.

I have a Westell 6100G modem. I want to set up Airport Express for wireless. Can someone tell me how to do it step by step. I'm using an HP with Windows Vista. I'm a tech idiot.

Just got Airport Express to save on GBs of data. I have already a Westell 6100G which is for use as Internet Broadband, via Verizon. How do I set up the Airport Express with this Westell. Do I even still need the Westell, or do I need to also buy a wireless router? I'm a tech idiot and this is driving me nuts.

The Westell 6100G is a combination modem and router or gateway device. The AirPort Express is a wireless router.
Since the Express does not have a built-in modem, you will still need your Westell gateway in order to access the Internet.
Which exact model of AirPort Express do you have. It will be written (in very hard to read type on a label on one of the AirPort's sides). It should look something like: A1392. It may also state a Order#. In that case it would look something like: MC414LL/A
Regardless of which model you have, the basic network configuration would be that you would connect an Ethernet cable between the Westell's Ethernet port and the WAN (circle of dots) port on the Express. (Note: If you have an earlier model of the Express, you would connect the cable to the only Ethernet port on the Express.)
The good news is that you will not have to make any configuration changes to the Westell. We should be able to use it as configured.
What we are going to start with is getting a basic Wi-Fi network that should provide your computer with wireless access to the Internet. Once verified as working, we can fine-tune this network to include wireless security and any other goals that you may have.
Ready to start?
I would recommend that you do the following as a minimum:
Power-down the Westell and computer(s).
While all of the devices are powered-down, perform a "factory default" reset on the AirPort Express base station. This will get it back to its "out-of-the-box" configuration and make setting it up much easier, especially if you use the "Assist me" process within the AirPort Utility. (ref: Resetting an AirPort Base Station or Time Capsule)
Once the reset has completed, remove the AirPort Express from power.
Connect an Ethernet cable between the Westell and the AirPort Express.
Power-up the Westell; wait at least 10-15 minutes to allow it adequate time to initialize.
Power-up the AirPort base station; wait at least 5-10 minutes. Note: The AirPort's status light may continue to flash amber after it has intialized. That is because, there may be some additional configuration items necessary, like setting up wireless security, before the overall setup is completed to get a green status.
Power-up your computer(s).
In this basic configuration, the AirPort base station will broadcast an unsecured wireless network with a Network Name (SSID) of Apple Network NNNNNN. Network clients, connected to the base station either by wire or wireless, should now be able to access the Internet through the ISP's modem. Once Internet connectivity has been verified, you can use the AirPort Utility to configure the base station for wireless security and any other desired options. Please post back your results.

How do i create an animation with one frame for each layer?

I have 76 sequential images that i've loaded as layers using bridge, then aligned using photoshop.
I would now like to create a 76 frame animation with one animation frame for each layer
(the layers are in sequential order).
is there an easy way to do this
or do i have to create 76 frames (can duplicate multiple to speed it up)
then set layer visibility for each frame?
thanks
bill w
astro.whwiii.net

thanks for all the replies
got it
here's a rough draft of 2 hours of sunshine
http://whwastro.homestead.com/files/big/31-05-2014-prom-animation.gif
-bill w
astro.whwiii.net

My mac has10.5.8 and should be compatible with new HP officejet pro 8600. I can't get it to install for wireless, nor to work with USB cable. Have tried downloading HP install directly from HP and it still doesn't work.

I just bought a new HP OfficeJet Pro 8600 printer. I have been unable to download the installation for wireless connection even though have had the assistance of Costco tech, HP tech and some advice from Apple. Because the system is MacOs 10.5.8 the error says it is incompatible, even though the product lists compatiblilty with 10.5, 10.6. I was advised 1 option might be to obtain Snow Leopard for installation, however am somewhat reluctant as the bo states 10.5 should work and Snow Leopard is 10.6, which is also listed as compatible. I am unable to get the printer to work even with USB cable. Too much time spent on this and I hate to start over with another printer because I'm afraid I might have the same trouble. Is Snow Leopard something I should get anyway? Help!

Snow Leopard has more compatible Java.
https://discussions.apple.com/docs/DOC-2455
explains more about upgrading to Snow Leopard.
If that doesn't work to fix the problem, then see my FAQ* on printing:
http://www.macmaps.com/printersx.html

How to restart base station from airport utility? I used to be able to do it remotely I currently use a Mac Pro 10.8.4 and have a time machine for wireless 6.3 (630.34). Sometimes I cannot connect to the internet and use network preferences to diagnose t

How to restart base station from airport utility? I used to be able to do it remotely
I currently use a Mac Pro 10.8.4 and have a time machine for wireless 6.3 (630.34). Sometimes I cannot connect to the internet and use network preferences to diagnose the issue. This results in being told to restart the wireless. The airport utility includes the drop down option of restarting but is not clickable so I can't choose it.
With my prior macbook and same time capsule, etc if i had problems connecting to the internet I would run network diagnostics to help out. This included clicking on the airport utility ---> base station --> restart. This worked most of the time.
Bottom line, is there something I am missing in not being able to restart the wi-fi remotely? ]
Thanks in advance

You are likely forgetting a step.
Open AirPort Utility
Click on the Time Capsule icon
Click Edit in the small window that appears
Now click the Base Station menu.....top of the screen....not the Base Station "tab" in the center of the screen
Click Restart

Iphone 4S updated to iOS 5.0.1 last nite no longer visible in iTunes for wireless sync. check box is viewable as checked when connected via usb. anyone else having this problem and been able to sort? Thanks.

Hi all. Update my iphone 4S via usb last night. Since then the iphone is not visible in itunes for wireless syncing. The sync wirelessly box is checked and is viewable as checked when phone connected via usb. Anyone else have this problem and been able to sort? Thanks. Doug

Hi all. Update my iphone 4S via usb last night. Since then the iphone is not visible in itunes for wireless syncing. The sync wirelessly box is checked and is viewable as checked when phone connected via usb. Anyone else have this problem and been able to sort? Thanks. Doug

I hooked up new iMac to wireless network and now iPad and iPhone do not work using wireless. I am using a Netgear N300 router. Also my Netgear ethernet/homeplug for wireless TV internet no longer works. Any ideas?

I hooked up new iMac to wireless network and now iPad and iPhone do not work using wireless. They did before hooking up the iMac. I am using a Netgear N300 router. Also my Netgear ethernet/homeplug for wireless TV internet no longer works. Any ideas? I have tried unplugging, restarting, and resetting. No luck! Thanks!

You should probalby contact Netgear

NAC for wireless layer 3 oob

Similar Messages

Maybe you are looking for