Cisco NAC3350-PROF-K9 - NAC Profiler Server Installation Manual page 98

Installing the Clean Access Server
Figure 3-8
packet
In most cases, enabling Management VLAN tagging is not needed. You should only enable it if you
Note •
are sure it is necessary. If you choose not to enable it at this time, you can change the option later
in the web console or using
necessary when the trusted side of the CAS is a trunk, such as in Virtual Gateway deployments. In
this case, you will need to enable Management VLAN tagging and specify the VLAN ID to which
the trusted interface of the CAS belongs.)
Also note that faulty VLAN settings can render the Clean Access Server unreachable from the Clean
•
Access Manager, so be sure to use care when configuring VLAN settings.
Next configure the untrusted interface. This is the interface to the untrusted (managed) network. At the
Step 12
prompt type the address you want to use for the untrusted interface (eth1) and press Enter. Unless
deploying the Clean Access Server in a bridge (Virtual Gateway) configuration, the trusted and untrusted
interfaces must be on separate subnets. Confirm the value when prompted.
Please enter the IP address for the untrusted interface eth1 []: 10.10.10.10
You entered 10.10.10.10 Is this correct? (y/n)? [y]
Note For Virtual Gateways, the eth1 address most commonly used is the eth0 address. To prevent looping, do
not connect eth1 to the network until after you have added the CAS to the CAM in the web console. See
the Cisco NAC Appliance - Clean Access Server Configuration Guide, Release 4.8(3)
Type the subnet mask of the eth1 interface or press Enter to accept the default of 255.255.255.0. Confirm
Step 13
the value at when prompted.
Please enter the netmask for the interface eth1 []: 255.255.255.0
You entered 255.255.255.0, is this correct? (y/n)? [y]
Step 14 Enter the default gateway address for the untrusted interface:
If the Clean Access Server will act as a Real-IP gateway, this should be the IP address of the CAS's
•
untrusted interface eth1.
• If the Clean Access Server will act as a Virtual gateway (i.e. a bridge), this can be the same default
gateway address used for the trusted side.
Please enter the IP address for the default gateway []: 10.10.10.1
You entered 10.10.10.1 Is this correct? (y/n)? [y]
Cisco NAC Appliance Hardware Installation Guide
3-28
Chapter 3
Eth0 Egress Packets with Management VLAN ID Tagging
Untrusted network Trusted network
Clean Access
Server
service perfigo config
Installing the Clean Access Manager and Clean Access Server
Mgmt
ID
utility. (Management VLAN tagging is
Mgmt
ID
for further details.
OL-20326-01