HP 3350 - Cisco NAC Appliance Spezifikationen PDF herunterladen (Seite 102)

3-12

Cisco NAC Appliance - Clean Access Manager Configuration Guide

OL-28003-01

Chapter 3 Switch Management: Configuring Out-of-Band Deployment

Deployment Modes

Flow for Out-of-Band Real-IP Gateway Mode

1. The unauthenticated user connects the client machine to the network through an edge switch.

2. The switch sends MAC notification or linkup/linkdown SNMP traps for the client to the CAM.

Because the client is not on the Certified Devices List/Online Users list yet, the CAM sends an

SNMP SET trap to the switch instructing it to change the client port to the Authentication VLAN

specified in the Port Profile (100), and the CAM places the client on the Out-of-Band Wired Clients

list (OOB Management > Devices > Discovered Clients > Wired Clients).

Note To support a variety of switch configurations, Cisco NAC Appliance supports switches using both MAC

Change Notification and MAC Move Notification traps.

3. The unauthenticated client requests and receives an IP address on the Auth VLAN (x.x.100.x).

4. The client authenticates through the CAS via web login or the Agent. If configured, the client goes

through posture assessment, all the while transmitting and receiving traffic on the Auth VLAN (100)

to the CAS. When clean, the client is placed on the Certified Devices List. The CAS acts as the

default gateway while the client remediates. Only permitted traffic is allowed to pass through from

the untrusted to trusted interface.

5. At this point, the CAM instructs the switch to change the client switch port from the Authentication

VLAN (100) to the Access VLAN (10) (according to the Port Profile), and puts the client MAC

address on the Out-of-Band Online Users list (Monitoring > Online Users > View Online Users >

Out-of-Band).

6. The client port is switched to the Access VLAN and is bounced (as set in the Port Profile). When

the port is bounced, the client acts as if the network cable is unplugged, thus releasing its DHCP

binding on the interface. Once the port is brought back up from the shutdown state, the client

performs a DHCP renewal or discovery, as if it were connecting to the network for the first time.

Since the switch port is now on a different VLAN, the client receives a new IP address that is valid

for the access subnet.

7. With an IP address on the Access VLAN (x.x.10.x), the client now transmits traffic on the trusted

network, on the Access VLAN specified in the Port Profile.

8. Once the client is on the Access VLAN, the client’s traffic no longer goes through the CAS.

Note If the Cisco NAC Appliance system somehow terminates the OOB client session (if the system

administrator is forced to “kick” the user out, for example) and the switch changes the VLAN

assignment for the client’s access port from the Access VLAN back to the Authentication

VLAN, the client machine discovers the VLAN change and, if configured, initiates an IP address

refresh/renew to ensure the user stays connected to the network. For details on the polling

method and configuration guidelines, see Configure Access to Authentication VLAN Change

Detection, page 3-67.

9. For certified clients, the Port Profile form (OOB Management > Profiles > Port > New/Edit)

provides the following options (see Add Port Profile, page 3-34). You can switch the client to:

• The Access VLAN specified in the Port Profile form.

• The Access VLAN specified for the user role of the client, if you choose to use a role-based port

profile (see Figure 3-9 on page 3-27 for details).

1 2 ... 97 98 99 100 101 102 103 104 105 106 107 ... 680 681

Kommentare zu diesen Handbüchern

Keine Kommentare

HP 3350 - Cisco NAC Appliance Spezifikationen Seite 102

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für PC / Workstation Barebones HP 3350 - Cisco NAC Appliance