An engineer is deploying a Cisco NAC appliance in a highly routed environment and requires it to act as a DHCP server. What deployment model should be used?

The Layer 3 Virtual Gateway OOB Real-IP Gateway model is designed for routed networks where Layer 2 adjacency between the NAC appliance and clients does not exist. In this model, the NAC Server acts as the DHCP server and real-IP default gateway for untrusted clients, assigning addresses from its own pool until the client is authenticated and moved to the trusted network. OOB placement keeps it off the production forwarding path while still enabling DHCP and policy enforcement.

Layer 2 Virtual Gateway operates as a transparent bridge and is only suitable for Layer 2 adjacent same-subnet deployments, not highly routed environments.

Layer 2 Real IP requires Layer 2 connectivity between the NAC appliance and clients and does not scale to routed multi-subnet environments.

Layer 3 Real IP places the NAC appliance inline in a routed path but does not support the out-of-band DHCP server role needed for this scenario.