Cisco NAC3350-PROF-K9 Hardware Installation Guide - Page 106

Configuring the CAS Behind a NAT Firewall

Get Cisco NAC3350-PROF-K9 - NAC Profiler Server PDF manuals and user guides View all Cisco NAC3350-PROF-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 106 highlights

Cisco NAC Appliance Connectivity Across a Firewall Chapter 3 Installing the Clean Access Manager and Clean Access Server Table 3-2 Device CAS and firewall (if any) Port Usage (continued) Communicating Devices Ports to Open Agent (Windows OS) and Active Directory (AD) Server TCP 88, 135, 389, 445, 1025, 1026 UDP 88, 389 Purpose AD SSO requires the following ports to be open: • TCP 88 (Kerberos) • TCP 135 (RPC) • TCP 389 (LDAP) or TCP 636 (LDAP with SSL) Note When using LDAP to connect to the AD server, Cisco recommends using TCP/UDP port 3268 (the default Microsoft Global Catalog port) instead of the default port 389. This allows for a more efficient search of all directory partitions in both single and multi domain environments. • TCP 445 (Microsoft-SMB; e.g. needed for password change notices from DC to PC) • TCP 1025 (RPC)-non-standard • TCP 1026 (RPC)-non-standard If it is not known whether the AD server is using Kerberos, you must open the following UDP ports instead: • UDP 88 (Kerberos) • UDP 389 (LDAP) or UDP 636 (LDAP with SSL) Note When using LDAP to connect to the AD server, Cisco recommends using TCP/UDP port 3268 (the default Microsoft Global Catalog port) instead of the default port 389. This allows for a more efficient search of all directory partitions in both single and multi domain environments. If your deployment requires LDAP services, use TCP/UDP 636 (LDAP with SSL encryption) instead of TCP/UDP 389 (plain text). For more information on AD SSO, see the Cisco NAC Appliance Clean Access Server Configuration Guide, Release 4.8(3). Configuring the CAS Behind a NAT Firewall Caution If deploying a NAT firewall between the CAS and the CAM, the CAS must be in Standalone mode. Cisco NAC Appliance does not support High Availability CAS pairs when a NAT firewall is deployed on the trusted side of the CAS HA pair. If deploying the Clean Access Server behind a firewall (there is a NAT router between CAS and CAM), you will need to perform the following steps to make the CAS accessible: Step 1 Connect to the CAS by SSH or use a serial console. Log in as root user. 3-36 Cisco NAC Appliance Hardware Installation Guide OL-20326-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
3-36
Cisco NAC Appliance Hardware Installation Guide
OL-20326-01
Chapter 3
Installing the Clean Access Manager and Clean Access Server
Cisco NAC Appliance Connectivity Across a Firewall
Configuring the CAS Behind a NAT Firewall
Caution
If deploying a NAT firewall between the CAS and the CAM, the CAS must be in Standalone mode.
Cisco NAC Appliance does not support High Availability CAS pairs when a NAT firewall is deployed
on the trusted side of the CAS HA pair.
If deploying the Clean Access Server behind a firewall (there is a NAT router between CAS and CAM),
you will need to perform the following steps to make the CAS accessible:
Step 1
Connect to the CAS by SSH or use a serial console. Log in as
root
user.
CAS and
firewall (if
any)
Agent (Windows
OS) and Active
Directory (AD)
Server
TCP 88, 135, 389,
445, 1025, 1026
UDP 88, 389
AD SSO requires the following ports to be open:
•
TCP 88 (Kerberos)
•
TCP 135 (RPC)
•
TCP 389 (LDAP) or TCP 636 (LDAP with SSL)
Note
When using LDAP to connect to the AD server, Cisco
recommends using TCP/UDP port 3268 (the default
Microsoft Global Catalog port) instead of the default port
389. This allows for a more efficient search of
all
directory
partitions in both single and multi domain environments.
•
TCP 445 (Microsoft-SMB; e.g. needed for password change
notices from DC to PC)
•
TCP 1025 (RPC)–non-standard
•
TCP 1026 (RPC)–non-standard
If it is not known whether the AD server is using Kerberos, you
must open the following UDP ports instead:
•
UDP 88 (Kerberos)
•
UDP 389 (LDAP) or UDP 636 (LDAP with SSL)
Note
When using LDAP to connect to the AD server, Cisco
recommends using TCP/UDP port 3268 (the default
Microsoft Global Catalog port) instead of the default port
389. This allows for a more efficient search of
all
directory
partitions in both single and multi domain environments.
If your deployment requires LDAP services, use TCP/UDP
636 (LDAP with SSL encryption) instead of TCP/UDP 389
(plain text).
For more information on AD SSO, see the
Cisco NAC Appliance -
Clean Access Server Configuration Guide, Release 4.8(3)
.
Table 3-2
Port Usage
(continued)
Device
Communicating
Devices
Ports to Open
Purpose