Rules with Policy not working as intended

[Akkertje]

I have the following setup for testing purposes which i am unable to get working properly. i might be doing something wrong but i dont see what.

I have a role in Policy which i named LAB-CORP-ROLE. Clients logging in with dot1x (LAN and WLAN) get the proper Role. With this role i have defined a few basic rules:

I am testing this with LAN, i know we have to manualy rearrange the rules in the EWC, which is realy stupid, but that's my honest opinion...

The role is Contain to vlan, I think this has a implicit permit at the bottom of the rules?
i then allow: Base Services, the predefined ones: Permit IP ARP, BootP Server and DNS.

I created another rules which i called deny RFC's. I want to block all traffic to internal IP adresses and allow DNS, DHCP and ARP.

The client does get an IP but is unable to resolve DNS to an internal DNS server, even while ill explicitly allow udp 53 (to all ip's i suppose) If i add a permit to the IP of the internal DNS server it works fine. This is not what i want to do. I hope i made myself clear and i also hope someone here might be able to tell me what i am doing wrong.

I also tried to change the Access control on this role to Permit and then add the vlan to vlan Egress tab (untagged ofcourse) I can then see the switchport does get the untagged vlan on that port but ni mac adresses are being learned... Seems like a bug as well? Am i doing something wrong?

Kind regards!

[Akkertje]

Hi Brian,

I have seen the article and i must say that i understand such precedences must exist but i agree that we should be able to sort the rules with the Policy manager. I do however think that what i would like to accomplish is basic but i did some calls to other people i know which have more experience with NAC and they all tell me they do NOT use rules, they much rather use a firewall of sorts to get items like these sorted. We bought this product for this exact reason and it should not be so hard for us to implement rules... I already lost loads of time testing this stuff, it's getting frustrating really, working with this product.

Like the fact u have to manually change the rules in the EWC. This has been known for a long time but has yet to be resolve, i can't get my head around that...

Maybe others know how i can get this to work properly?

[Claudio_D_Ascen]

Hi
have you make a rule that permit TCP port 80, to go to the web?

Ciao CLaudio

[Akkertje]

Hi Claudio,

Since there should be a implicit permit this should not be necessary. And i am testing with nslookup. Web works fine IP based.