HP 3350 - Cisco NAC Appliance Spezifikationen PDF herunterladen (Seite 99)

3-9

Cisco NAC Appliance - Clean Access Manager Configuration Guide

OL-28003-01

Chapter 3 Switch Management: Configuring Out-of-Band Deployment

Deployment Modes

Note To support a variety of switch configurations, Cisco NAC Appliance supports switches using both MAC

Change Notification and MAC Move Notification traps.

3. The client attempts to acquire a DHCP address. The core L2 switch forwards all Auth VLAN traffic

to the Out-of-Band Virtual Gateway CAS.

4. The CAS receives the VLAN 100 traffic on its untrusted interface (via the 802.1q trunk).

5. With VLAN mapping rules already configured to map the Auth VLAN to the Access VLAN (under

Device Management > CCA Servers > Manage [CAS_IP] > Advanced > VLAN Mapping), the

CAS retags the allowed DHCP traffic from VLAN 100 on its untrusted side to VLAN 10 on its

trusted side and forwards the retagged traffic on its trusted interface to the L3 router/DHCP server.

Note When the CAS is a Virtual Gateway, it can only be in DHCP Passthrough mode. When VLAN mapping

is used for Out-of-Band, the default permissions on the filters transparently allow DNS and DHCP traffic

from the untrusted interface, and no additional traffic control policies need to be configured. See the

Cisco NAC Appliance - Clean Access Server Configuration Guide, Release 4.9(x) for details on VLAN

mapping.

6. From the router’s point of view, this is a request from VLAN 10. The router returns the DHCP

response to VLAN 10 on the CAS.

7. With VLAN mapping rules enabled, the CAS retags the allowed traffic (on the 802.1q trunk) from

VLAN 10 to VLAN 100 and forwards the DHCP response to the initiating client.

8. The client authenticates through the Clean Access Server via web login or the Agent. If configured,

the client goes through posture assessment, all the while transmitting and receiving traffic on the

Auth VLAN (100) to the CAS. All traffic that is permitted for remediation is allowed to pass through

the CAS, and is placed on VLAN 10. If the traffic is not permitted, it is dropped. When certified, the

client is placed on the Certified Devices List.

9. At this point, CAM sends an SNMP SET trap to the switch instructing it to change the client port

from the Auth VLAN (100) to the Access VLAN (10) (as specified in the Port Profile), and puts the

MAC address of the client in the OOB Online Users list (Monitoring > Online Users > View

Online Users > Out-of-Band).

10. Because this is an OOB Virtual Gateway deployment, and the client already has an IP address

associated with the Access VLAN, the client port is not bounced after it is switched to the Access

VLAN.

11. Once the client is on the Access VLAN, the client is on the trusted network and the client’s traffic

no longer goes through the Clean Access Server.

Note If the Cisco NAC Appliance system somehow terminates the OOB client session (if the system

administrator is forced to “kick” the user out, for example) and the switch changes the VLAN assignment

for the client’s access port from the Access VLAN back to the Authentication VLAN, the client machine

discovers the VLAN change and, if configured, initiates an IP address refresh/renew to ensure the user

stays connected to the network. For details on the polling method and configuration guidelines, see

Configure Access to Authentication VLAN Change Detection, page 3-67.

1 2 ... 94 95 96 97 98 99 100 101 102 103 104 ... 680 681

Kommentare zu diesen Handbüchern

Keine Kommentare

HP 3350 - Cisco NAC Appliance Spezifikationen Seite 99

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für PC / Workstation Barebones HP 3350 - Cisco NAC Appliance