带外模式部署CISCO NAC案例.pdf

NAC Out−Of−Band (OOB) Wireless Configuration Example Document ID: 107645 Contents Introduction Prerequisites Requirements Components Used Conventions Background Information Cisco NAC Overview Virtual Gateway Mode (Bridge Mode) Out−of−Band Mode Single Sign−On Configure NAC OOB Wireless Solution Catalyst Switch Configuration Steps to Configure NAC OOB on the WLC and NAC Manager Configuring Single Sign−On (SSO) with the OOB Wireless Solution Steps to Configure SSO on the NAC Manager Steps to Configure SSO on the Wireless LAN Controller Verify CISCO WLC CLI Commands for Verification Client State Verification from WLC GUI Verification of Single Sign−On on the NAC Server with WLC Troubleshoot Troubleshooting Commands Related Information Introduction This document provides design guidance to deploy Out of Band (OOB) Cisco Network Admission Control (NAC) appliance endpoint security in a Cisco Unified Wireless Network deployment. These best practice recommendations assume that a Cisco Unified Wireless Network has been deployed in accordance with the guidelines provided in the Enterprise Mobility Design Guide 3.0. The recommended design is the Virtual Gateway (Bridge Mode) and central deployment OOB solution with RADIUS Single Sign−On. The Wireless Lan Controller (WLC) must be placed L2 adjacent to the NAC server. The client associates to the WLC, and WLC authenticates the user. Once the authentication is completed, the user traffic goes through the quarantine VLAN from the WLC to the NAC server. The posture assessment and remediation process take place. Once the user is certified, the user VLAN changes from quarantine to access VLAN in the WLC. The traffic bypasses the NAC server when moved to access VLAN. Prerequisites Requirements This document configuration is specific to the NAC 4.5 and WLC 5.1 release Components Used This document is t restricted to specific softwa