Okay, prefacing this that I have no clue about any aspect of how this
works on the mac, I have somebody who uses parallels on a Macintosh.
They can connect fine on the Macintosh side, but when they start
Parallels they need to download the CCA agent. I noticed that they have
a different IP and mac address on the Parallels side. Once they start
the Clean Access Agent and type their username and password it says:
"Login Failed - Access to network is blocked by the administrator". I
don't see anything in the event log for this. This is on an inband
connection.

Any pointers, thoughts, or otherwise.

-Simon