HP 3350 - Cisco NAC Appliance Spezifikationen PDF herunterladen (Seite 160)

3-70

Cisco NAC Appliance - Clean Access Manager Configuration Guide

OL-28003-01

Chapter 3 Switch Management: Configuring Out-of-Band Deployment

Out-of-Band Users

Wired

Clients and

Wireless

Clients

• The Wired Clients and Wireless Clients lists (Figure 3-33 on page 3-53 and Figure 4-20 on page 4-24)

record the activities of Out-of-Band clients (regardless of VLAN), based on the SNMP trap information

that the CAM receives.

• For Wired OOB clients, the CAM adds a client’s MAC address, originating switch IP address, and switch

port number to the Out-of-Band Discovered Clients list after receiving SNMP trap information for the

client from the switch. The CAM updates the entry as it receives SNMP trap information for the client.

• For Wireless OOB clients, the CAM adds a client’s MAC address, IP address, associated WLC, Access

Point MAC address, and Authentication (Quarantine) and Access VLAN assignments to the Wireless

Clients list. Thereafter, the CAM updates the entry as it receives new SNMP trap information for the

wireless client.

• Removing an entry from the Wired Clients or Wireless Clients list clears this status information for the

OOB client from the CAM.

Note For Wired OOB clients, an entry must exist in the Wired Clients list in order for the CAM to determine

the switch port for which to change the VLAN. If the user is logging in at the same time that an entry

in the Discovered Clients list is deleted, the CAM will not be able to detect the switch port.

Out-of-Band

Online Users

• The Out-of-Band Online Users list (Figure 11-25 on page 11-32) tracks all authenticated Out-of-Band

users that are on the Access VLAN (on the trusted network).

• The CAM adds the client MAC address to the Out-of-Band Online Users list after a client is switched to

the Access VLAN.

Note The “User IP” of an OOB online user is the IP address of the user on the Authentication VLAN. By

definition Cisco NAC Appliance does not track users once they are on the Access VLAN; therefore

OOB users are tracked by the Authentication VLAN IP address they have while in the Cisco NAC

Appliance network.

• When a user is removed from the Out-of-Band Online Users list, the CAM instructs the switch or

Wireless LAN Controller to change the VLAN of the port from the Access VLAN to the Authentication

VLAN.

Note For Wired OOB clients, if the Cisco NAC Appliance system somehow terminates the OOB client

session (if the system administrator is forced to “kick” the user out, for example) and the switch

changes the VLAN assignment for the client’s access port from the Access VLAN back to the

Authentication VLAN, the client machine discovers the VLAN change and, if configured, initiates an

IP address refresh/renew to ensure the user stays connected to the network. For details on the polling

method and configuration guidelines, see Configure Access to Authentication VLAN Change

Detection, page 3-67.

• Additionally, if Bounce the port after VLAN is changed is checked for the Port Profile (Real-IP

gateways), the following occurs:

1. The CAM bounces the switch port (off and on).

2. The switch resends SNMP traps to the CAM.

3. The CAM discovers the device connected to the switch port from SNMP MAC change

notification/MAC move notification or linkup traps received.

4. The port is assigned the Auth VLAN if the device is not certified.

5. The CAM changes the VLAN of the port according to the Port Profile configuration

Table 3-4 Wired and Wireless User List Summary

User List Description

1 2 ... 155 156 157 158 159 160 161 162 163 164 165 ... 680 681

Kommentare zu diesen Handbüchern

Keine Kommentare

HP 3350 - Cisco NAC Appliance Spezifikationen Seite 160

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für PC / Workstation Barebones HP 3350 - Cisco NAC Appliance