Hi All,
After a while of not doing anything with NAC, I am going to change up a configuration I made a year ago for a customer. I need some new roles with some new vlans etc. Security is done by using a firewall (FortiGate) so no need for rules etc.
I created a few vlans on the switches (2 stacks of 3 switches X440-G2) and these are imported nicely in the policy manager. I made some new roles to which I added contain to VLAN (With the vlans I created) and now it's time to enforce the configuration to the NAC to be able to use all them roles etc for real.
I always do a verify, as I did now and I get a lot of domain mismatches from the Wireless controllers. I fixed some of these issues by just importing the roles from the WLC to the policy domain but not all. (this was needed because we do a splash page etc for guests on the WLC.
I am more concerned by the following messages which I hope someone can tell me what exactly will happen if I go ahead and enforce this:
Role [name] mismatch - following needs to be written: [Access Ctrl/VLANxxx] to x.x.x.x
- Have a few of those, will this be changed with the enforce or is this a message that I need to change this before enforcing.
Some messages regarding some rules which need to be removed but no statement why they need to be removed.
- Will the enforce remove the rules? Or is this (again) just a notification?
The following VLANs [xxx][xxx][xxx][xxx] do not exist.
- Will these be created by the enforce or will I need to do this myself?
And some transmit queue port group statements, I do not even use so I am not too bothered about these.
The main question is: Will a enforce just change a bunch of this (add, remove and edit) or will it just add things and not remove and edit?
Hope you can help answer my questions 🙂
