3-28
Cisco NAC Appliance Hardware Installation Guide
OL-20326-01
Chapter 3 Installing the Clean Access Manager and Clean Access Server
Installing the Clean Access Server
Figure 3-8
Eth0 Egress Packets with Management VLAN ID Tagging
Note
•
In most cases, enabling Management VLAN tagging is not needed. You should only enable it if you
are sure it is necessary. If you choose not to enable it at this time, you can change the option later
in the web console or using
service perfigo config
utility. (Management VLAN tagging is
necessary when the trusted side of the CAS is a trunk, such as in Virtual Gateway deployments. In
this case, you will need to enable Management VLAN tagging and specify the VLAN ID to which
the trusted interface of the CAS belongs.)
•
Also note that faulty VLAN settings can render the Clean Access Server unreachable from the Clean
Access Manager, so be sure to use care when configuring VLAN settings.
Step 12
Next configure the untrusted interface. This is the interface to the untrusted (managed) network. At the
prompt type the address you want to use for the untrusted interface (eth1) and press Enter. Unless
deploying the Clean Access Server in a bridge (Virtual Gateway) configuration, the trusted and untrusted
interfaces must be on separate subnets. Confirm the value when prompted.
Please enter the IP address for the untrusted interface eth1 []: 10.10.10.10
You entered 10.10.10.10 Is this correct? (y/n)? [y]
Note
For Virtual Gateways, the eth1 address most commonly used is the eth0 address. To prevent looping, do
not connect eth1 to the network until after you have added the CAS to the CAM in the web console. See
the
Cisco NAC Appliance - Clean Access Server Configuration Guide, Release 4.8(3)
for further details.
Step 13
Type the subnet mask of the eth1 interface or press Enter to accept the default of 255.255.255.0. Confirm
the value at when prompted.
Please enter the netmask for the interface eth1 []: 255.255.255.0
You entered 255.255.255.0, is this correct? (y/n)? [y]
Step 14
Enter the default gateway address for the untrusted interface:
•
If the Clean Access Server will act as a Real-IP gateway, this should be the IP address of the CAS’s
untrusted interface eth1.
•
If the Clean Access Server will act as a Virtual gateway (i.e. a bridge), this can be the same default
gateway address used for the trusted side.
Please enter the IP address for the default gateway []: 10.10.10.1
You entered 10.10.10.1 Is this correct? (y/n)? [y]
et
h
0
eth
1
Mgmt
ID
Mgmt
ID
Trusted network
Untrusted network
Clean Access
Server
184083
packet
