Cisco Cisco NAC Appliance 4.9.5 技术手册

Introduction
 Prerequisites
      Requirements
      Components Used
      Conventions
 Background Information
      Cisco NAC Overview

Virtual Gateway Mode (Bridge Mode)
      Out−of−Band Mode
      Single Sign−On
 Configure NAC OOB Wireless Solution
      Catalyst Switch Configuration
      Steps to Configure NAC OOB on the WLC and NAC Manager
Configuring Single Sign−On (SSO) with the OOB Wireless Solution
      Steps to Configure SSO on the NAC Manager
      Steps to Configure SSO on the Wireless LAN Controller
 Verify
      CISCO WLC CLI Commands for Verification
      Client State Verification from WLC GUI
      Verification of Single Sign−On on the NAC Server with WLC
 Troubleshoot
      Troubleshooting Commands
 Related Information

This document provides design guidance to deploy Out of Band (OOB) Cisco Network Admission Control
(NAC) appliance endpoint security in a Cisco Unified Wireless Network deployment. These best practice
recommendations assume that a Cisco Unified Wireless Network has been deployed in accordance with the
guidelines provided in the Enterprise Mobility Design Guide 3.0.

The recommended design is the Virtual Gateway (Bridge Mode) and central deployment OOB solution with
RADIUS Single Sign−On. The Wireless Lan Controller (WLC) must be placed L2 adjacent to the NAC
server. The client associates to the WLC, and WLC authenticates the user. Once the authentication is
completed, the user traffic goes through the quarantine VLAN from the WLC to the NAC server. The posture
assessment and remediation process take place. Once the user is certified, the user VLAN changes from
quarantine to access VLAN in the WLC. The traffic bypasses the NAC server when moved to access VLAN.