You are designing an Out of Band Cisco Network Admission Control. Layer 3 Real-IP Gateway deployment for a customer. Which VLAN must be trunked back to the Clean Access Server from the access switch?

An authentication VLAN is not a standard component in the OOB Layer 3 Real-IP Gateway model; the untrusted VLAN serves as the holding segment for unauthenticated clients requiring CAS inspection.

The user VLAN is the trusted, post-authentication segment where clients are placed after passing posture checks, so it does not need to be trunked to the CAS for admission control.

The untrusted VLAN is the segment where clients reside before completing posture assessment; trunking it to the Clean Access Server allows the CAS to intercept client traffic, enforce policy, and control access before permitting entry to the trusted network. Without this trunk, the CAS cannot see or act on unauthenticated clients in the OOB Layer 3 Real-IP Gateway deployment model.

The management VLAN carries out-of-band device management traffic and is unrelated to client posture assessment or admission control logic in NAC deployments.