NAC AAA rule assentment .
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎05-31-2016 02:17 AM
NAC 6.3.0.168, Wireless V2110 9.21.09.0004
I have a strange issue with devices not using the right AAA rule in the NAC even though when checking the device via the NAC evaluation tool tells me it should be using the right rule.
The NAC is setup for proxy Radius to a windows NPS server. When I run the NAC evaluation tool I get the correct information below with the correct rule "BYOD-test" passed.
BUT looking at the NAC end-systems data for that device it goes to the end "catch-all" rule, not the rule the evaluation tool displays.
Any idea's where to look or are there other tools I can use for testing?
I have a strange issue with devices not using the right AAA rule in the NAC even though when checking the device via the NAC evaluation tool tells me it should be using the right rule.
The NAC is setup for proxy Radius to a windows NPS server. When I run the NAC evaluation tool I get the correct information below with the correct rule "BYOD-test" passed.
BUT looking at the NAC end-systems data for that device it goes to the end "catch-all" rule, not the rule the evaluation tool displays.
Any idea's where to look or are there other tools I can use for testing?
7 REPLIES 7
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎06-01-2016 03:05 AM
Just a update. Problem found and fixed.
Like to thank everyone for showing me the way to looking at the extended logs. I did not know they existed. From the logs I found the BYOD rule was skipped by the NAC when it was processing the rule order. From this I assumed I did run "Enforce all" on the NAC when I first created the rule but it seems I did not. Enforced the rule and now working as intended.
Like to thank everyone for showing me the way to looking at the extended logs. I did not know they existed. From the logs I found the BYOD rule was skipped by the NAC when it was processing the rule order. From this I assumed I did run "Enforce all" on the NAC when I first created the rule but it seems I did not. Enforced the rule and now working as intended.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎05-31-2016 10:38 AM
If you show the End System Group that you're keying off of and the User Group that would help with troubleshooting. Otherwise, like Zdenek said, you can get seem more diagnostics from the NAC appliance itself.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎05-31-2016 03:40 AM
Yes, you need more logging. What is NAC seeing in the RADIUS packet? Is it sending all the info you expect? What does it look like from a NAC perspective (if you search for the end system and view its "status" ?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎05-31-2016 03:28 AM
Https:/:nac-gw:8444 there you should have diagnostics tools and log. The username and password is configured in your nacmanager
Regards
Zdeněk Pala
