Configuring the Network for OOB Deployment
■ Step 1: Connect the machines and switches and record these network settings:
- Administration and access VLANs
- Authentication VLAN
- Switch IP addresses
- Cisco NAC Appliance interface
■ Step 2: Configure the IP address for the switch and the administration and access VLANs.
■ Step 3: Configure these SNMP miscellaneous settings:
- SNMP server administration contact information
© 2007 Cisco Systems, Inc. All rights reserved CANAC v2.1—3-3
For the out-of-band authentication sequence to work, you must configure your switches and routers so that they can be managed by the Cisco NAM.
Note Refer to your switch documentation for details on configuring your specific switch model.
To configure the network for Cisco NAC Appliance out-of-band deployment, complete these steps:
Step 1 Connect the machines and switches. Write down the administration and access VLANs, authentication VLAN, switch IP addresses, and Cisco NAC Appliance interface.
Step 2 Configure the IP address for the switch and the administration and access VLANs. Step 3 Configure SNMP miscellaneous settings such as the following:
# snmp-server location <location_string>
# snmp-server contact <admin_contact_info>
© 2007 Cisco Systems, Inc. Cisco NAC Appliance Implementation 3-101
■ Step 4: Configure SNMP read-only community string (apply ACLs for better security).
■ Step 5: Configure SNMP write community string (SNMPvl and SNMPv2c) or username and password (SNMPv3).
■ Step 6: Enable these SNMP traps for the switch:
- MAC notification traps, if supported
- Otherwise, linkup and linkdown traps
© 2007 Cisco Systems, Inc. All rights reserved CANAC v2.l—3-4
Step 4 Configure the SNMP read-only community string. Apply access control lists (ACLs) for increased security. Here is an example configuration:
# access-list 20 permit 10.201.0.0 0.0.255.255
# snmp-server community c2950_read ro 20
Step 5 Configure the SNMP write community string, either SNMPvl or SNMPv2c, or username and password (SNMPv3). You can apply ACLs here for increased security. Here is an example configuration:
# access-list 21 permit host 10.201.2.15
■ SNMPvl and SNMPv2c settings: Consider an example in which the SNMP read-write community string is "c2950_write". The following command string would be used:
# snmp-server community c2950_write rw 21
■ SNMPv3 settings: Consider an example in which the SNMP username is "c2950_user" and the password is "c2950_auth". The following command strings would be used:
# snmp-server group c2 950_group V3 auth read v1default write v1default
# snmp-server user c2 950_user c2 950_group V3 auth md5 c2950_auth access 21
3-102 Implementing Cisco NAC Appliance (CANAC) v2.1 © 2007 Cisco Systems, Inc.
Step 6 Enable SNMP traps for the switch. Cisco NAC Appliance uses the MAC notification trap by default. If the switch does not support the MAC-notification trap, the Cisco NAM uses the SNMP linkup or linkdown trap. To enable MAC-notification traps, use this command:
# snmp-server enable traps mac-notification
If MAC notification is not supported, enable linkup and linkdown traps using this command:
# snmp-server enable traps snmp linkup linkdown
Alternatively, you can simply enable all traps using this command:
# snmp-server enable traps
© 2007 Cisco Systems, Inc. Cisco NAC Appliance Implementation 3-103
|
Configuring the Network for OOB |
||
|
Deployment (Cont.) |
||
|
■ Step 7: Enable switch to send SNMP traps to the Cisco NAM. |
||
|
!Sample switch configuration for SNMPv3, where SNMP username is |
||
|
!"cam user" and password is "cam auth" ! |
||
|
snmp-server user cam user cam group v3 auth md5 cam auth |
||
|
snmp-server host 10.201.2.15 traps version 3 auth cam user udp-port |
||
|
162 mac-notification snmp |
||
|
snmp-server group camgroup v3 auth read v1default write v1default |
||
|
notify v1default |
||
|
© 2007 C |
co Systems, Inc. All rights reserved. CANAC v2.1—3-5 |
|
Step 7 Enable the switch to send SNMP MAC notification and linkup traps to the Cisco NAM. The switch commands in the following examples depend on the SNMP version that is used in the SNMP trap settings in the Cisco NAM configuration:
■ This example uses SNMPvl with an SNMP community string "nam_v1":
# snmp-server host 10.201.2.15 traps version 1 nam_v1 udp-port 162 mac-notification snmp
■ This example uses SNMPv2c with an SNMP community string "nam_v2":
# snmp-server host 10.201.2.15 traps version 2c nam_v2 udp-port 162 mac-notification snmp
■ The following example uses SNMPv3 with an SNMP username and password "nam_user" and "nam_auth". The group command should be run after the user and host commands.
# snmp-server user nam_user nam_group V3 auth md5 nam_auth
# snmp-server host 10.201.2.15 traps version 3 auth cam_user udp-port 162 mac-notification snmp
# snmp-server group nam_group V3 auth read v1default write v1default notify v1default
Note For better security, you should use SNMPv3 and define ACLs to limit SNMP write access to the switch.
3-104 Implementing Cisco NAC Appliance (CANAC) v2.1 © 2007 Cisco Systems, Inc.
|
Configuring the Network for OOB Deployment (Cont.) |
||
|
■ Step 8: Enable the portfast command on the switch port interface. |
||
|
!Sample switch configuration |
||
|
spanning-tree portfast |
||
|
© 2007 Cisco |
ystems, Inc. All rights reserveO. |
CANAC v2.1—3-6 |
Step 8 Enter interface configuration mode and enable the portfast command to bring a port more quickly to a Spanning Tree Protocol (STP) forwarding state. Use this command:
# spanning-tree portfast
Note Enabling the STP feature on a port that is connected to a switch or hub could prevent STP
from detecting and disabling loops in your network. Refer to your switch documentation for details.
© 2007 Cisco Systems, Inc. Cisco NAC Appliance Implementation 3-105
This topic describes how to configure group profiles on the Cisco NAM for out-of-band deployment.
Continue reading here: Configuring Port Profiles
Was this article helpful?