This is an abbreviated notetaking of a freestyle NAC appliance installation...
We started out by settting up vmware host as Linux Other 32 bit. Installed Cisco NAC OS CD iso 2.7.2. The first server is the NAM or NAC Access Manager adn the second is the NAS or the NAC Access Server. The NAC acess server needed two nics. Both needed 1 GB of RAM. We also set up the NICS as E100 NICS. This seemed to help.
After booting up, the NIC's were all messed up. Had to shut down the eth1 interface, shut the eth0 interface bring backup eth0 and it replied.
could not add host nas server. error. Issue is with trust on self signed certs. Must import the cert for each server to each server.
go to;
https://NAS IP ADDRESS/Admin
why? because they remove all untrusted ssl certs. have to manually add the cert to each device. have to export nad import each way.
Manager. go to cca manager. ssl certs. trunsted cert authorities. IMPORT the cert from where you exported it to a file. now do the reverse.
go back to CAM Manager and now add the server. Should sync. had to down and up eth0 again for kicks...???? Hmmm. VMware???
manage device from the server tab.l
Enable L2 Strict mode [check]
Advanced Tab -- Mapping
now add all the vlans we will be monitioring. Since we are only monitoring one, the NIC on that vlan is already in teh list. if there were more we wouldhave to add them.
Added DHCP Scope and auto generated subnets
Back to Manager...
OOB Management Profiles -- Group -- NEW (adding switches) ADD
Devices -- New
snmp-server community public RO 15
snmp-server community public RO 15
snmp-server community publicRW RW 15
snmp-server enable traps snmp linkup
snmp-server enable traps snmp linkdown
snmp-server enable traps mac-notification change move threshold
snmp-server host 10.228.xxx.xx version 2c public
Devices - search- input ip range of switches to discover based on SNMP.
found em
SET up a port profile...
OOB Manaagement -- Profiles -- Ports
NEW Profile -- VLAN Settings -Auth Ports is what i called it.
VLAN id for the authvlan
Access Vlan is for a "Fail Open" situation
check all 3 bottom options - move to auth port.
set up ports and devices. set ports for auth
go to Administraton --- User Pages -- Edit the default page.
We imported an image and set some options.
From here we began to work with the SNMP strings and test some functionality. It seems that the server is quite grumpy on eth1 on the NAS server. the nic is not responding or giving out DHCP addresses as we configured it to do. We made a phone call for parachute help with our problem. The situation was relayed to us that the NAS Server secondary NIC should be on its own physical NIC. We didnt have another nic in our vsphere environment so we called it a night and will take it up later.
All good fun working with Doug from Cisco on the Cisco Clean Access NAC appliance. We at Peak IP Solutions really appreciate your help!
Cheers!
Doug
www.peakipsolutions.com
