NAC L3 OOB designs are a bit of a pain if you can't afford IOS images to run VRFs!