How to de-integrate NAC from a Layer 2 / Layer 3 network (RBE/PBR)?

To de-integrate or remove NAC from a Layer 2 or Layer 3 network, please follow the relevant instructions below.

Each set of instructions applied to a specific network management device and brand.

If you do not see your network device listed, please open a case with OPSWAT Support by following the instructions in the support box at the end of this article.

RBE (Layer 2 - RADIUS Based Enforcement)

Aruba Controllers

Aruba Open or PSK SSIDS

• Execute the following command on the master controller.

• To prevent devices getting stuck in a blocked state, you can have the system mark all devices in quarantined states as compliant, by executing the following command.

• To re-integrate NAC, type the following command.

Aruba WPA2E SSIDS

1. To remove RBE from the RADIUS path of your network, you must remove or demote the entry pertaining to the RBE server from the controller’s RADIUS configurations.

• Navigate to Configuration>Authentication>AAA Profiles, and select the 802.1X Authentication Server Group of the profile used by your SSID.

• Either delete or demote the entry for the NAC RBE Device.

• Alternatively, this can be done from the CLI by replacing devradius.pd.impulse.com with the NAC Appliance, and replacing rbetest2.pd.impulse.com with an alternate RADIUS server, as illustrated below.

2. To prevent devices getting stuck in a blocked state, you can have the system mark all devices in quarantined states as Compliant, by executing the following command.

3. To re-integrate NAC, enter the following command.

Cisco Controllers

Cisco Open SSIDS (AireOS versions prior to and including V 8.3.102.0)

1. To turn MAC filtering off, click on WLAN>Security>Layer 2, then uncheck MAC Filtering.

2. To set Layer 3 Security to None, click on WLAN>Security>Layer 3, then select None from the drop-down menu.

3. To uncheck AAA Override, click on WLAN>Advanced, then uncheck AAA Override, as illustrated below.

To re-integrate NAC, do the following.

4. To turn MAC filtering on, click on WLAN>Security>Layer 2, then check MAC Filtering.

5. To set Layer 3 Security to Web Policy, click on WLAN>Security>Layer 3, select Web Policy from the drop-down menu, then ensure that both On MAC Filter Failure and the sc_quarantine_acl ACL are selected.

6. To check AA Override, click on WLAN>Advanced, then check AAA Override.

Cisco Open SSIDS (AireOS versions subsequent to and including V8.3.102.0)

1. To turn MAC filtering off, click on WLAN>Security>Layer 2, then uncheck MAC Filtering.

2. To uncheck AAA Override, click on WLAN>Advanced, then uncheck AAA Override.

To re-integrate NAC, do the following.

3. To turn MAC filtering on, click on WLAN>Security>Layer 2, then check MAC Filtering.

4. To check AAA Override and set the NAC State, click on WLAN>Advanced, then check AAA Override and select Radius NAC or ISE NAC.

Cisco WPA2E SSIDS

1. To set the RADIUS authentication server to an alternate RADIUS server, navigate to WLAN>Security>AAA Servers, then set Server 1 to Alternate RADIUS Server.

2. To set Allow AAA Override to Disabled and set the NAC state to None, navigate to WLAN>Advanced, then uncheck Allow AAA Override and set NAC State to None.

To re-enable NAC, do the following.

3. To set the RADIUS authentication server to NAC RADIUS server, navigate to WLAN>Security>AAA Servers, then set Server 1 to NAC RADIUS Server.

4. To check AAA Override and set the NAC State, click on WLAN>Advanced, then check AAA Override and select Radius NAC or ISE NAC.

Aerohive Controllers

Aerohive HM6 Open, WEP, WPAPSK WLANS

1. To disable MAC authentication, navigate to Configuration>SSIDs>(Name of Open / WEP or WPAPSK SSID), then uncheck Enable MAC Authentication, click Save and push the updated policy.

2. To re-integrate NAC, navigate to Configuration>SSIDs>(Name of Open / WEP or WPAPSK SSID, then check Enable MAC Authentication, click Save and push the updated policy.

Aerohive HM6 WPA2E/802.1X WLANS

1. Navigate to Configuration>SSIDs>(Name of Secure SSID), then change SSID Access Security to Open, click Save and push the updated policy.

2. To re-integrate NAC, navigate to Configure>SSIDs>(Name of Secure SSID), then change SSID Access Security to WPA/WPA2 802.1X (Enterprise), click Save and push the updated policy.

Aerohive HMNG Open, WEP, or WPAPSK WLANs

1. To turn off MAC authentication, navigate to Configure>(Name of policy)>Wireless Settings>(Name of Secure SSID)>MAC Authentication, then disable MAC Authentication, click Save and push the updated policy.

2. To re-integrate NAC, navigate to Configure>(Name of Policy)>Wireless Settings>(Name of Secure SSID)>Mac Authentication, then enable MAC Authentication, click Save and push the updated policy.

Aerohive HMNG WPA2E/802.1X WLANs

1. Navigate to Configure>(Name of Policy)>Wireless Settings>(Name of Secure SSID), then change SSID Access Security to Open, click Save and push the updated policy.

2. To re-integrate NAC, navigate to Configure>(Name of Policy)>Wireless Settings>(Name of Secure SSID), then change SSID Access Security to Enterprise, click Save and push the updated policy.

PBR (Layer 3 - Policy Based Routing)

To clear the opswat_block ACL, enter the device-relevant commands and instructions below.

NEXUS Router

Cisco/Brocade ICX Router (Non NEXUS Router)

Alcatel Router

HP Router

Huawei Router

MLX Router

The following script is for removing the NAC route map, where X = the Layer 3 interface that has the route map applied.

X can be determined by issuing a show ip policy command, then reviewing the results to determine which interfaces have the route map applied.

Then, to restore the NAC route map, enter the following script.