Installation guide

The NAC Controller Policy Configuration
6-16 Initializing the NAC Controller
The NAC Controller Policy Configuration
ReviewthefollowingconsiderationspriortoconfiguringpolicyonNACControllerPEPdevices:
Setup the VLAN Configurations
NACControllerPEPVLANconfig urationmustconformwiththe requirementsofyournetwork
topology.DuringNACControllerEnginemanagementinitializationforOut‐Of‐Band
managementconfigurations,youenteredamanagementVLANforthisNACController.For
Out‐Of‐Bandconfigurations,thismanagementVLANenteredduringinitializationispushed
downtothe
PEP.
ForIn‐Bandmanagement,theNACControllermanagementVLANsareconfigured.The
managementVLANSareVLAN1forL2andVLAN90forL3.TherearealsoanumberofVLANs
configuredsuchas3056forPortMirroringor3089forQuarantine.Itisimportantthatyounote
these
defaultsanddetermineiftheyaredesirableorinconflictwithVLANsalreadypresentin
yournetwork.
TodisplaycurrentVLANsettingsandmakeanychangestoVLANconfigurationsprovidea
consoleconnectiontotheNACControllerPEPhost.0.1.
ForL2accesstotheCLIforNACControllerPEPconfiguration,connect
theconsoletotheNAC
ControllerPEPCOMport.TheCOMportlocationisshowninFigure 6‐23.TheNACController
PEPCLIpromptwilldisplay.
Figure 6-23 NAC Controller PEP COM Port Location
Usetheshowportvlanhost.0.1commandtodisplaythecurrentVLANconfiguratinforthisNAC
ControllerPEP.Usetheshowvlancommand
todisplayallconfiguredVLANs.Onceyouhave
determinedchangesthatmayberequired,referencetheDFE‐PlatinumandDiamondSeries
ConfigurationGuideforinformationpertainingtoVLANconfiguration.
NAC Controllers Require Separate Domains
TheNACControllercanbeconfiguredinoneoftwomodesofoperation:L2orL3.Themodeof
operationcontrolshowconnectingendsystemsaredetectedbytheNACControlleronthe
networkandisselectedbasedonwheretheNACControllerispositionedinthenetworkin
relationto
theseendsystems.IftheNACControllerispositionedbeforethefirstroutedboundary
forconnectingendsystemsclosertotheaccessedgeofthenetwork,theL2NACControllermode
isutilized.IftheNACControllerispositionedafterthefirstroutedboundarydeeperinsidethe
network,theL3
NACControllermodeisutilized.