Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 702

Configuring NAC Chapter 41 Configuring Network Admission Control • When NAC Layer 2 IP validation is enabled, you must configure an ACL on the switch port to which hosts are connected. • The ACL must permit EAPoUDP traffic for LPIP to function. • NAC Layer 2 IP does not validate the posture of IPv6 traffic and does not apply access policies to IPv6 traffic. • NAC Layer 2 IP is not supported if the switchport is part of a private VLAN. • NAC Layer 2 IP ARP traffic redirected to the CPU cannot be spanned using the SPAN feature. • A denial-of-service attack might occur if the switch receives many ARP packets with different source IP addresses. To avoid this problem, you must configure the IP admission MLS rate-limiting feature using the mls rate-limit layer2 ip-admission command. • If DAI is also enabled on the parent VLAN of the switch port, the IP admission rate limiting for ARP packets directed to the CPU is ineffective. In this situation, ARP inspection rate limiting is functional. ARP inspection rate limiting is performed in software and IP admission rate limiting is performed in hardware. • DHCP snooping must be enabled if the switch wants to use DHCP lease grants to identify connected hosts. DHCP packets are permitted in DHCP environments in both the default interface and the downloaded host policy. • If you want the end stations to send DNS requests before posture validation occurs, you must configure the named downloadable ACL on the switch port with ACEs permitting DNS packets. • If you want to forward the HTTP and HTTPS requests from an endpoint device to a specific URL, you must enable the HTTP server feature. The url-redirect-acl AV pair should be defined as the URL ACL name. This ACL should contain a deny tcp any remediation server address eq www command followed by the permit ACEs for the HTTP traffic that is being redirected. • If NAC Layer 2 IP validation is configured on a switch port that belongs to a voice VLAN, the switch does not validate the posture of the IP phone. Make sure that the IP phone is on the exception list. • If NAC Layer 2 IP validation is enabled, the NAC Layer 2 IP configuration takes precedence over VLAN ACLs and router ACLs that are configured on ingress interfaces. For example, when a VLAN ACL and a router ACL are configured, the operation applies the policies serially in the order of the LPIP policy to VLAN ACL to router ACL. The next policy is applied only when the traffic passes through the previous policy check. Any policy in the serial order denying the traffic causes the traffic to be denied. The downloaded LPIP host policy always overrides the default interface policy. • The DHCP traffic should be permitted in the interface default ACL and the host policy for DHCP snooping to function. • If dynamic ARP inspection is enabled on the ingress VLAN, the switch initiates posture validation only after the ARP packets are validated. • The traffic sent to the URL-redirect deny ACEs is forwarded in hardware without applying the default interface and the downloaded host policies. If this traffic (that is, the traffic matching the deny URL-redirect ACEs) requires filtering, you should define a VLAN ACL on the switch port access VLAN. This configuration allows you to bypass the redirection of the HTTP traffic destined for the remediation servers. 41-12 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY OL-11439-03