NAC Feature "RADIUS Clients to Monitor NAC"

[M_Nees]

During playing around (for another huge installation) in my lab NAC, i stumble over the above feature!

RADIUS Clients to Monitor NAC ??

Are there any use cases or configuration examples? Current Online Help, NAC Manuals are not helpful.

What is the difference between using "RADIUS Clients to Monitor NAC" or to configure a out-of-band system (like nagios) in standard "switch section" as regular RADIUS client to test RADIUS requests?

replys are welcome.

[Ryan_Yacobucci]

Hello Matthias,

Please see the following help section description for the service:

Any authentication request coming from an IP address that matches the list of RADIUS monitor clients will be authenticated using the password you provided in the AAA mapping. In these cases, the username does not matter. The password configured will not be able to be used for authentication from any other part of the network. The Access Control engine responds back with a basic accept to any RADIUS monitor client’s RADIUS request.

Thanks
-Ryan

[Erik_Auerswald]

Hello Matthias,

as I understand this feature, it can be used to monitor NAC using e.g. Nagios/Icinga (or Spectrum or ...) with a special account that is valid for monitoring only. This account does not allow network access. This is more secure than using a real user account for monitoring.

Erik