NAC Inband Trunk on Untrusted Interface

Hi,
I am query regarding inband implementation of NAC server.
Is it possible to have multiple vlans to terminate on the untrusted interface of the NAS in real gateway mode?
Is this is the case, how can I add an IP address to each vlan ID on the untrusted interface.
The aim is to implement the following deployment.
The network architecture is a collapsed Core, Distribution/Core on the same 2 switchs with SVIs on the distribution switchs for all the vlans. Since the network may not have all cisco switchs, I am forced to use Inband deployment.
I wanted to trunk required vlans to the NAC untrusted interface, remove the SVIs on the Distribution Switchs forcing vlan clients onto the NAC.
The trusted NAC interface will be connected to a SVI vlan or L3 interface on the distribution switch.
Since the NAC is in real gateway mode, DHCP pool or DHCP relays need to configure on the NAC server as well.
As a summary, can you please advise if it is possible to create something like SVIs on the NAC untrusted port and define DHCP relay on those SVIs on the untrusted interface.
Thanks,
Ashley

never mind,
I didn't add VLAN 111 to the VLAN database.
not it is working.
thanks
Alex

Similar Messages

NAC untrusted interface and DHCP

Hi All,
I've setup OOB-L3-RIP, then connect NIC2 (untrusted interface) to the switch. then create VLAN interface (111) as untrusted VLAN in switch. then on switch:
#interface gi 1/3
#switchport mode access
#switchport access vlan 111
but I can't ping from the switch to untrusted interface of NAS and vice versa. also NAS is not assigning IP address to the host as DHCP server.
any suggestion would be very appreciated.
thanks
Alex

never mind,
I didn't add VLAN 111 to the VLAN database.
not it is working.
thanks
Alex

NAC Inband RealIP-Gateway address

Hi Experts,
I want to configure NAC appliance in INBAND-CENTRAL DEPLOYMENT-REAL IP GATEWAY.
In this scenario, my clients are in different VLANs say 2 & 3. To all my clients the default gateway should be the IP Address of NAC. Correct?
Where I will configure this IP address in the NAC box so that this IP Address will be the default gateway for my clients.
I know that the "managed subnet" option in the NAS is for ARP resolution only and not this IP can be used as default gateway for Clients.
Do i have to create some virtual IP address in the NAC Ethernet card?
Please help me by sharing your thoughts
Sairam

Hi Sairam,
I put some configure samples about L2 IB for you:
interface GigabitEthernet1/33
description To Trusted
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 998
switchport trunk allowed vlan 31,40,110
switchport mode trunk
interface GigabitEthernet1/34
description To Untrusted
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport trunk allowed vlan 41,311,400
switchport mode trunk
There are some notes you should know:
1) NAC server -> core sw: trunking (see details on the above configuration)
2) Authen VLan: 311, 400 (these should NOT have SVI (Layer 3) interface anywhere on the network)
Access Vlan: 31, 40
You should map 311 -> 31, 400 -> 40 on NAC server.
3) CAS is going to be the default gateway for users
Hope this help!
NamNT

NAC Inband Layer 2 VG

Hello Dear's,
My company ordered NAC and ACS 1120 My question is Can i configure 802.1X security through ACS server and NAC in layer 2 Inband Virtual Gateway.for campus switches.
Is it the good design to have double security for switch ports. 1st is 802.1X and 2nd is NAC in layer 2 INBAND VG
Thanks.
Message was edited by: estela mathew

Hello Dears,
Any suggestion please Experts,

FT VLAN / Trunk or L3 Interface? ACE 4710 setup

Hello, Is it possible to use 1 or 2 of the 4 gigabit ethernet ports from one ACE straight into the other ACE for redundancy?
So ACE_01 gig0/4 to ACE_02 gig0/4
If so, is it a case of just having the layer 3 config instead of trunking etc..
Also - is it possible to create a context within the same vlan as the Admin context?
Thank you
Please rate useful posts and remember to mark any solved questions as answered. Thank you.

Hello Kanwal, thank you for this. This is my first pair of ACE's configuring from scratch.
I've dedicated int gi1/4 for the ft 'transit' traffic if you like - its dedicated on a separate vlan. So both ACE's are connected directly on this port.
I have two VLANs - 724 & 725
And 3 contexts. Admin, NPE, DEV
The Admin Context lives in VLAN 724 I created another context (NPE) in the same VLAN. Do I have to use a different address for the interface in this context or can I use the same as the Admin context?
SQP-ACE4710-NPE01/FOS_NPE# conf t
Enter configuration commands, one per line. End with CNTL/Z.
SQP-ACE4710-NPE01/FOS_NPE(config)# interface vlan 724
SQP-ACE4710-NPE01/FOS_NPE(config-if)# ip address 172.27.24.5 255.255.255.0
Error: Specified ip address duplicates with an existing ip address configured in the context
Thank you
Please rate useful posts and remember to mark any solved questions as answered. Thank you.

[svn:fx-trunk] 5028: IGraphicElement interface clean-up and optimizations.

Revision: 5028
Author: [email protected]
Date: 2009-02-20 16:02:17 -0800 (Fri, 20 Feb 2009)
Log Message:
IGraphicElement interface clean-up and optimizations.
Animating a GraphicElement that doesn't share the Group's DO should be now faster and smoother since redrawing it won't redraw the Group anymore.
1. Group doesn't always clear the first sequence of display objects now
2. Moved the shared DO logic almost entirely into Group
3. More granular invalidation for GraphicElements
QE Notes: Make sure we have test that count the number of display objects for a given set of graphic elements and a group
Doc Notes:
Bugs: None
Reviewer: Glenn, Ryan, Jason
tests: None
Modified Paths:
flex/sdk/trunk/frameworks/projects/flex4/src/mx/components/Group.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/components/baseClasses/GroupBase.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/core/InvalidatingSprite.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/graphics/BitmapGraphic.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/graphics/IGraphicElement.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/graphics/StrokedElement.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/graphics/baseClasses/GraphicElement.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/graphics/baseClasses/TextGraphicElement.a s
flex/sdk/trunk/frameworks/projects/framework/src/mx/core/IVisualElement.as
Added Paths:
flex/sdk/trunk/frameworks/projects/flex4/src/mx/graphics/ISharedDisplayObject.as
flex/sdk/trunk/frameworks/projects/flex4/src/mx/graphics/baseClasses/ISharedGraphicsDispl ayObject.as

NAC 4.9 CAS inband with ASA 8.6

We are working on a new deployment. The user logs in, the agent pops, and posture assessment happens. The screen for posture assessment closes at the test laptop. It acts like all is working. When we look at the inband user it shows as not having transitioned frm the auth the access VLAN. This is a simple install and the VLAN mapping is definitely there. Ideas?

Steve,
Here is a configuration guide for the ASA to CAS, its not the latest and greatest but this should work:
http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a008074d641.shtml
When referrring to L2 and L3 adjacent this is different with respect to VGW and RIP.
L2 and L3 refers to how the clients are positioned with respect to the CAS (not the CAM), are they being routed to the CAS untrusted interface or are they available on a vlan that the CAS can be a part of.
VGW and RIP refers to the operation of the CAS, this is similar to the operation of the ASA, when it comes to transparent vs routed mode (you can use both the on same CAS), VGW bridges the two networks together, and RIP routes the traffic around and requires static routing since the CAS does not support dynamic routing protocols.
You can use VGW by setting the group policy to route all tunneled traffic to an ip that is present on the trusted side of the CAS, also you can use the vlan attribute in the group-policy configuration to assign the remote users to a vlan which forces their traffic to flow through the CAS.
http://cisconac.blogspot.com/2007/07/vpn-deployments-with-asa-80.html
Thanks,
Tarik Admani
*Please rate helpful posts*

NAC in Inband L2 Virtual mode

Dear Experts,
I m planning to implement NAC INBand virtual mode,as if i have HP and cisco switches in my network,I have read the installation guide and cisco press book for NAC,as if now i want confirmation from you'll experts the step by step procedure to setup NAC,
As i thought to post because many of you'll have implemented NAC for several times so the general steps to start,as i m going to do antivirus update and windows update for the host posture assessment,
NAC in Inband L2 Virtual mode
About my thinking for Implementation is :
create authentication vlan on access switches,(no SVI for authentication vlan)
Do authentication mapping and actual user vlan mapping in NAC,
create a rule such as windows update and antivirus update and then requirement is to access the antivirus server and windows update server,
allow Access-list for all the user vlan to go these antivirus and windows update server BUT these ip's will be the actual vlan IP subnet because we will not have any authentication subnet in DHCP ??????? Correct me if i m wrong.
Shift the users from actual vlan to authentication vlan,
Configure managed subnet for the reply of DHCP request
Enable L3 and setup static routes
Manually go on each and every PC to open a browser so that it will be redirected to install NAC agent, IS THERE any other way TO INSTALL NAC AGENT IN 1000 WINDOWS MACHINE, MINE SYSTEM ADMINISTRATOR ARE NOT VERY SMART,SO PLEASE ANY SOLUTION WITHOUT ANY HELP OF SYSTEM ADMINISTRATOR?????? IT WILL BE HIGHLY APPRECIABLE.
The point above i have worte,, that is what i think NAC is any other point's if i m missing please plese please advice me.or give proper guidance.

Hi,
1. This is correct. Auth VLANs shouldn't have SVIs anywhere on the network
2. Okay
3. Okay. For posture assessment, look at chalktalk 5 from this link: http://bit.ly/chalktalks
4. For a L2 VGW setup (assuming In-Band), you will only have one set of IP addresses to work with, and those would be the Access VLAN IP addresses. You don't get a different IP address in your Auth VLAN. You can limit the resources you want your clients to have access to by tweaking the Traffic Policies
5. You would map the users, and you do that by defining the VLAN mappings
6. For L2 deployments, you will need managed subnets for all the IP subnets that you work with.
7. You don't need static routes for L2 deployments
8. If your clients are using any managed software system, like GPOs using AD, or SMS, or Altiris, you can push out the agent to them using those mechanims.
HTH,
Faisal

Catalyst 6500 L3 interface trunk

We have a catalyst 6509 with IOS version 12.1(26)E6. On a layer 3 interface can we configure trunking as normal router?

So, then you need to create 1 interface vlan for each subnet
int vlan 10
ip address 10.10.1.0 255.255.255.0
int vlan 20
ip address 10.10.2.0 255.255.255.0
create the vlans
vlan 10
vlan 20
use trunk on the interface giga...
and you'll have inter-vlan routing.
check this link:
http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a008015f17a.shtml
Please rate all helpful post.
Vlad

NAC In-band Real IP Gateway process

Hi all,
I've been doing a lot of research and I still can't find good answers to some of my questions. All the big questions are answered for out-of-band configuration but I find that it's assumed that understanding in-band is taken for granted lol...I guess I'm slow =P
How does In-band Real-IP Gateway work?
What is the point of the /30 subnets?
Are there access/auth VLAN pairs in in-band configurations?
How does quarantining work?
I read that the NAC Server can only send traffic out the untrusted port in one VLAN and that you aren't allowed to trunk that port. Does this mean that there's no support for multiple untrusted VLANs mapped to a single NAC Server?
Can you do role-mapping with in-band configurations?
Any help with any or all of these questions would be GREATLY appreciated!
Thanks much =]
~ Xavier.

Hi Xavier,
let me try to answer your questions
1.How does In-band Real-IP Gateway work?
The CAS works in routed mode, so you have different IP addresses (on different subnets) on the trusted and untrusted interfaces. Since the CAS doesn't support routing protocols, all the routing has to be configured through static routes
2. What is the point of the /30 subnets?
The idea is to have small subnets for your clients so that with this IP config the clients in the authentication VLAN need to go through the CAS even to talk to other clients in the same L2 subnet.
Check here for some explaination:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/47/cas/s_dhcp.html#wp1057889
3. Are there access/auth VLAN pairs in in-band configurations?
If you ask if there's VLAN mapping, then the answer is NO, as the aim of the VLAN mapping is to *bridge* traffic between the trusted and untrusted mapped VLANs, but in Real-IP the CAS does L3 routing of the traffic.
4. How does quarantining work?
When a client is quarantined, this works in the same way as in OOB, as in this phase the client is still inline to the CAS.
So the concept is that the CAS assigns the user to the temporary or quarantine role and it applies a traffic policy that you configured for the temporary or quarantine role.
5. I read that the NAC Server can only send traffic out the untrusted port in one VLAN and that you aren't allowed to trunk that port. Does this mean that there's no support for multiple untrusted VLANs mapped to a single NAC Server?
The "single" VLAN restriction for Real-IP CAS applies only to the *trusted* side. The CAS can be the default gateway for multiple VLANs/IP Subnets on the *untrusted* side.
You configure additional VLAN/IP addresses on the untrusted side using the "managed subnet" configuration.
This is also mentioned here:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/45/cas/s_deploy.html#wp1050938
The Clean Access Server can manage one or more subnets, with its untrusted interface acting as a gateway for the managed subnets. For details on setting up managed subnets, see Configuring Managed Subnets or Static Routes, page 5-26.
6. Can you do role-mapping with in-band configurations?
Yes, you can do it! However, you cannot assign VLANs as you do in OOB but you can assign different access level based on the IP traffic policies and bandwidth restrictions you assign to the specific role.
Check for instance here for more details:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/45/cam/m_users.html#wp1040231
In a nutshell, irrespective of the use of InBand vs. OutOfBand:
- the clients are InBand to the CAS during the CAS discovery, authentication, posture assessment and remediation phases.
The main difference occurs when the user is authorized to have access to the network and you perform role assignment both in IB and OOB but..:
- in IB the client traffic keeps on flowing inline to the CAS, so you can apply different access policies (ACL) and bandwidth control policies depending on the role (but you cannot assign VLAN);
- in OOB the client traffic bypasses the CAS once it's authorized: in this case you can apply different VLANs but (since the CAS is no longer along the path) you can't apply ACLs and/or traffic shaping policies in this case.
I hope this answers your questions.
Regards,
Federico
If this answers your question please mark the question as "answered" and rate it, so other users can easily find it.

NAC OoB and WLC Causing flap and network down

I'm trying to intall a NAC Solution in a Wireless network but it's causing a MAC address flapping between switches interfaces and it's bringing the network down.
I've done the deployment following the Cisco documentation:
(WLC)-----(L2 Switch)-----(NACServer)--------(L3 Switch3com)
|_____________________________|
One connection from L2 to L3 throught NAC and one trunk out-of-band.
I Filtered the Vlans that should only be showed in the trunks but it keeps causing flapping when I plug the untrusted interface of NAC.
The only thing is that I wasn't able to take the Vlan 1 out of the Trunk in the 3Com switch (NAC Trusted interface).
Anybody has experienced this before and get solved?

yes, you can do it, just remember that the accounting server IP address must be the "service IP address" of the trusted management interface of the CAS

NAC - wanna test the basic setup - does not work !!!!

SCENARIO :
·         I have simple NAC setup with 1 NAC MGR “CAM” and 1 NAC SRVR “CAS”
·         My users are running network 192.168.10.x/24 , and I wanna implement in L2 VG mode. Both NAC MGR and NAC SRVR can ping each other.
·         CAM VLAN 55 = 192.168.55.x/24 , and CAS VLAN 66 = 192.168.66.x/24
·         NAC MGR “CAM” has only 1 cable going to the core switch and NAC SRVR has 2 cables going to the core switch ( one is trusted trunk end and another is untrusted trunk end) . Created two VLANS 999 and 998 and put each of them on each link as blackhole prevention mechanism described in Cisco docs.
·         I have a Windows 2008 DHCP Server who is giving the pool of IPs for users from 192.168.10.x/24 and it is working fine. Routing in the core switch is also ok.
·         I have SSH and web access to both CAM and CAS boxes. They are also updating online smoothly.
·         From the GUI, I have created the AV Rules also and CAM shows CAS as connected as well !!!! My version is 4.1.8 (upgraded from 4.1.3 )
INT VLAN 10 (USER VLAN) SVI is on core switch = 192.168.10.254 /24
INT VLAN 55 ( MGMT ) SVI is on core switch = 192.168.55.254/24
INT VLAN 66 (MGMT) SVI is on core switch = 192.168.66.254/24
PROBLEM :-
1.       I am not able to download or get the NAC Client software MSI or stub file or ActiveX prompt to download ….
2.       I don’t know how to start troubleshooting at this stage. Please note that My client PC is windows XP machine and the port is already configured to VLAN 100.
I have 1 CORE switch only and my NAC boxes and client are connected to the same CORE switch.

VLANS Mapping is done in CAM, i didnt find any field in CAS...
Also, i am copying the switch port configs... ( a simple logical connectivity diagram was attached also to this discussion already )
VLANS DATABASE
==============
vlan 10
name AuthVLAN
vlan 11
name TEST_VLAN_USER
vlan 55
name NAM_mgmt
vlan 998
name DummyVLAN998
vlan 999
name DummyVLAN999
*** Only SVI is VLAN 10 with network = 192.168.11.x/24 , there is no SVI for VLAN 11 ***
Following ports are configured as follows :-
============================================
interface GigabitEthernet2/9
description ** NAS's untrusted interface **
switchport
switchport trunk native vlan 999
switchport trunk allowed vlan 11
switchport mode trunk
no ip address
interface GigabitEthernet2/10
description **** NAS Mgmt interface IP 192.168.66.1 *****
switchport
switchport trunk native vlan 998
switchport trunk allowed vlan 10,66
switchport mode trunk
no ip address
interface GigabitEthernet2/11
description *** Test User Acess Port ***
switchport
switchport access vlan 11
switchport mode access
no ip address
interface GigabitEthernet2/12
description ***** Connected to Eth0 NAM on IP 192.168.55.1 ***
switchport
switchport access vlan 55
switchport mode access
no ip address
spanning-tree portfast
spanning-tree bpduguard enable
*** FROM THIS core switch I can ping 192.168.66.1 and also 192.168.55.1 with comfort ***
** Please note that actual IPs are 192.168.x.y and not 10.10.x.y respectively

NAC IB with wireless users

I have a problem here guys, I will deploy cisco NAC with wireless users
My scenario is IB-VG , the access points are autonomous there is no WLC
the AP is connected to the switch on a trunk port and I have configured the AP
with different SSIDs each one with different vlan (s) on the NAC i have
configured the vlan mapping and the managed subnets but it doesn't work.
i wanna know where is the problem or is there anu configuration example to configure \
autonomous AP in In-Band virtual gateway mode

Hi,
Can you please be more specific about what does not work?
What were you expecting to see and what are you seeing?
Do the wireless users get IP address?
If, yes, are they getting the IP you would expect?
After getting IP address, if you open a web browser dod you get redirected to the NAC login page?
If yes, do you enter the credentials and fail autentication?
Please note that you will need to make sure that the VLAN on the clients is allowed on the untrusted interface of the CAS, and that the VLAN mapping maps this VLAN to a vlan where a DHCP server can be reachable.
Also, please make sure that the traffic on the VLAn configured on the SSID has the only path as the path going through the CAS.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

NAC Appliance Configuration Question

Hi,
I am building a new VPN implementation for a customer using a Cisco ASA 5550 and a NAC 3350 appliance. Due to the availability of switch ports, my customer is inquiring to see if the ASA can be cabled directly to the untrust interface on the CAS. I plan to implement the CAS in VGW mode.
If this is possible, how would the VLAN Mapping work in VGW with this implementation? Do I need to configure a trunk on the ASA to pass the VLAN tags to the CAS to MAP the untrust to the trusted VLAN?
Thanks for your assistance.

Thanks Jesse,
I do agree having this configuration will limit them on redundancy and most likely we will go with a switched approach. If we have both the untrusted and the trust interfaces connected to the same switch with an edge deployment do I need VLAN mapping configured or can the NAC bridge the two vlans without the mapping? I suspect without mapping we would introduce loops.
Based on the examples I've seen on cisco.com with VPN concentrators, VLAN mapping is used with 4 vlans. 2 are native vlans and a untrusted and an untrusted VLAN - this was the same approach I was going to use. Also note that the ASA will not be used for Internet access, only VPN. See below image - the ASA would connect to the switch as an access port on VLAN3. The customers internal lan would connect to VLAN2.

WLCM and NAC-NME configuration

Has anybody deployed WLCM and NAC-NME in the same ISR3800 box? What's the best practise and is there any configuration example?
customer has a small site where has one 3825, one WLCM(interface Integrated-Service-Engine1/0) and one NAC-NME(interface Integrated-Service-Engine2/0) are put in the 3825, GE0/0 of the 3825 connect to internal L3 switch, GE0/1 connect to internet. one WLAN had been configured in the WLCM(version 6.0.188) and will be protected by the NAC-NME(version 4.6.1).
It is said that NAC-NME not support OOB mode, can only work in In-Band mode. Since real IP Gateway mode has a lot of limitation, so can the NAC-NME be configured in In-Band Virtual Gateway mode? If yes, then how to setup a Layer2 connection between the WLCM(interface Integrated-Service-Engine1/0) and the untrusted interface(external G 0) of the NAC-NME?
What I can think is:
let me assume the quarantined Vlan of this WLAN is 310, real Vlan is 311, both the NAC-NME's untrusted interface(external G 0) and GE0/0 of the 3825 are connected to a 3750E L3 switch's G1/0/1 and G1/0/2, untrusted interface management vlan is 304, trusted interface management vlan is 303, then I can configure:
1. For 3825:
interface GigabitEthernet0/0.310
encapsulation dot1Q 310
bridge-group 1
interface GigabitEthernet0/0.311
encapsulation dot1Q 311
bridge-group 2
interface Integrated-Service-Engine1/0.310
encapsulation dot1Q 310
no ip address
bridge-group 1
interface Integrated-Service-Engine1/0.311
encapsulation dot1Q 311
no ip address
bridge-group 2
bridge 1 protocol ieee
bridge 2 protocol ieee
2. For 3750E:
interface GigabitEthernet1/0/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 304,310,311
switchport mode trunk
interface GigabitEthernet1/0/2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 310,311
switchport mode trunk
but how to configure interface Integrated-Service-Engine2/0 of the 3825 which is connected to the trusted interface of the NAC-NME?
interface Integrated-Service-Engine2/0.303
encapsulation dot1Q 303
ip address x.x.x.x
interface Integrated-Service-Engine1/0.311
encapsulation dot1Q 311
ip address y.y.y.y
3. NAC-NME will configure VLAN mapping 310<-->311
I have not tested these configurations(I don't have access the 3825 yet, will be able to access it next week), but I'm afraid since GigabitEthernet0/0.311 of 3825 had been configured as a bridge port, maybe Integrated-Service-Engine1/0.311 can't be configured as a L3 port.
Anything else need to configure? or is there any other better design and configuration example? Any input is highly appreciated!

You got a defective unit. Open a TAC case to get a replacement.

NAC Inband Trunk on Untrusted Interface

Similar Messages

Maybe you are looking for