DNS Packets

[mascarenhas2010]

Hello Dears,

I m connecting Cisco NAC on HP 5406,When user login the DNS packets are not reaching to NAC though they both are connected on same 5406 switch.

The Working of cisco NAC is as follows:

1)Vlan mapping are done on NAC Server for example vlan 10 access vlan mapped to vlan 20 unauthenticate vlan.

2) Access vlan Switch virtual interface (SVI) are created on HP 5406 and unauthenticate vlan SVI are not created on 5406 switch because they are mapped on NAC.

3)The user PC should be in unauthenticate vlan because when user try to put username and password and try to login the request first come to NAC from which it looks that host is allowed to go on the network or not. BUT the situation here is that the user when try to login his DNS request are not reaching to NAC.

And i m getting the message domain not available.

IF THIS POST IS NOT CLEAR THAN SIMPLY THINK THAT ON 5406 DNS REQUEST ARE NOT REACHING TO CISCO NAC.

WHAT CAN BE THE SOLUTION.

[Pieter 't Hart]

If the client is not yet authorized, all trafic should remain in the guest vlan.

So I don't think it is strange the client cannot reach the DNS before it is authorized.

Only when the authentication/authorization is completed, the client port is reconfigured for another vlan and data can pass through to other networks.

Does your configuration need some athentication clients software installed (like Cisco Secure Client), so that this client software negotiates with the NAC?

please specify more information about switchport configuration.

[mascarenhas2010]

Hello Dear,

No the NAC works in a differnet way

The NAC job is to enforce security policies for example: antivirus or WSUS update should be present in each and every PC of the corporate, IF they are not update than NAC will not allow the host to login in network.

So actually the job starts when the user is authenticated by AD,which is integrated with NAC.when user credential are OK then NAC starts to check security enforcement if the host is updated than it will be allowed to the Network and if it is not updated than it is routed to remediation path.

When user is in unauthenticate vlan and when the user try to login it gets Domain not available message is pop up.

Below is the file attached for configuring
NAC IN INBAND VIRTUAL MODE

2) If i wan to configure a trunk port the command shld be as follows correct me if i m wrong.

vlan2#tagged A12

The above command means vlan 12 is allowed to flow on trunk port A12.

Thanks