Cisco Cisco Clean Access 3.5

The Clean Access Manager uses RMI for parts of its communication with the Clean Access Server, 
which means it uses dynamically allocated ports for this purpose. For customer deployments that have 
firewalls between the CAS and the CAM, Cisco recommends setting up rules in the firewall that allow 
communication between the CAS and CAM machines, that is, a rule that allows traffic originating from 
the CAM destined to the CAS (and vice versa). 

For release 3.5(x), TCP ports 80, 443, 1099, and 32768~61000 (usually 32768~32999 are sufficient) are 
required.

If deploying the Clean Access Server behind a firewall (there is a NAT router between CAS and CAM), 
you will need to perform the following steps to make the CAS accessible:

Connect to the CAS by SSH or use a serial console. Log in as root user.

Change directories to

 /perfigo/agent/bin/

.

Edit the file 

startagent

.

Locate the 

JAVA_OPTS

 variable definition in the file.

Add 

caserver1_hostname>

 to the variable, replacing 

 with the host name of the server you are modifying. For example: 

Restart the CAS by entering the 

 command.

Repeat the preceding steps for each Clean Access Server in your deployment. 

Connect to the Clean Access Manager by SSH or using a serial console. Login as 

.

Change directories to

/etc/

.

Edit the hosts file by appending the following line:

where:

<

>

 – The address that is accessible outside the firewall. 

<

> 

– The host name of each Clean Access Server behind the firewall. 

The CASes should now be addressable behind the firewall.