1. If you access the WebView -> "Status" -> "Agent Based" of the NAC Gateway to which the Agents connect and search on the IP of the end-system (ES) is it found?
a. Are these systems connected both wired and wireless at the same time?
b. Which interface is connected in the Agent-Based report?
c. Does the IP of the Agent match the IP of the ES as discovered in the main NAC "End-Systems Tab?
2. Determine which End-Systems (ES) are displaying the behavior.
a. Please record the MAC and IP Address of (1) or (2) for testing.
b. Please also record approximately how many ES are affected out of the total on-site.
c. Please relay any ES specific details of the affected ES that may yield a commonality (OS Type, Service Pack, common application, make, model, etc.)
3. Note that the NAC-Side and Client diagnostics listed below can be run simultaneously. Please do so, if at all possible.
1) In the NAC Manager, please access the "End Systems Diagnostics", and input both the MAC and IP Address of the (1) or (2) Test ES. The "ES Diagnostics" can be accessed by:
a. Right-clicking on the NAC Gateway against which the test ESs are Authenticating.
b. Selecting WebView from the Drop-Down Menu.
c. Selecting "Diagnostics" -> "End-System Diagnostics"
2) Let the test system(s) run thru (1) or (2) complete cycles of the observed behavior.
3) Please re-enter the "ES Diagnostics", and disable them.
4) Access the NAC Gateway via SCP, and off-load the "/var/log/tag.log".
Note: Two common SCP Clients are "WinSCP" and "FileZilla Client"
5) Please access the NAC Manager and Export the ES Events for the test ES(s) by:
a. Selecting the test ES in the ES Tab at the top of the screen.
b. Right-clicking on any of the ES Events that will now be displayed in the End-Systems Events Tab (located in the middle of the screen, below the ES Tab at the top).
c. Selecting "Table Tools" -> "Export", and export the ES Events for the test ES(s) as individual "*.csv" files.
d. Note: If the timeframe of the event just observed, please hit the "Search for Older Events" (2) or (3) times to fill in the time-frame.