NAC implementation wi thout DHCP Server

Question

Dear Experts,
Is it possible to deploy NAC without having DHCP server in the network? We have some 300-400 users in the campus and want to enable NAC for them.
As per my understanding Cisco NAC cannot be deployed without DHCP server in the network, however it is not documented anywhere on the site. Currently all users' machines are configured with static IP.
We want to do user authentication, AV remediation and Patch deployment through NAC. Is it possible to deploy NAC without DHCP server??
Thanks in advance.
nayan       

Answer 1

Hi,
Here is the basic flow of clean access for both inband and out of band: (http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/prod_white_paper0900aecd802bdc42.html)
Figure 1. Laptop Attempts to Access the Internal Network
1.  When the laptop first accesses the network, the Cisco Clean Access  Server determines that the computer's MAC address is not in the list of  certified devices, and that laptop is placed into an unauthenticated  role. While in this role, only User Datagram Protocol (UDP) Port 53  (Domain Name System [DNS]) and Dynamic Host Control Protocol (DHCP)  traffic (via DHCP and VLAN passthrough) is allowed.
2. The laptop gets an IP address from the DHCP server, but cannot get past the Clean Access Server acting as an IP filter.
3.  The laptop user opens a browser and is redirected to an SSL-based Web  login page where she enters her credentials, which in turn map her into  the "employee" role.
4. As an "employee," she is asked to download the Clean Access Agent.
5.  The Clean Access Agent performs the posture assessment and forwards the  results to the Clean Access Server to make the network admissions  decision.
Tarik Admani
*Please rate helpful posts*