Enterasys Networks 9034385 manual Scenario 1 Implementation

Page 42

Scenario 1: Intelligent Wired Access Edge

Scenario 1 Implementation

In the intelligent wired edge use scenario, the five NAC functions are implemented in the following manner:

1.Detection ‐ The userʹs end‐system connects to the network. The edge switch sends a RADIUS authentication request (802.1X, web‐based, or MAC authentication) with the associated credentials to the NAC Gateway.

2.Authentication ‐ If the end‐system is authenticating to the network using 802.1X or web‐based authentication, the NAC Gateway proxies the RADIUS authentication request to a backend authentication (RADIUS) server to validate the identity of the end user/device. For end‐systems that are MAC authenticating to the network, the NAC Gateway can be configured to either proxy the MAC authentication requests to the RADIUS server or locally authorize MAC authentication requests. If only MAC authentication is deployed on the network, and the NAC Gateway is configured to locally authorize MAC authentication requests, a backend RADIUS server is not required for the Enterasys NAC solution.

3.Assessment ‐ After the identity of the end‐system or end user is validated via authentication, the NAC Gateway requests an assessment of the end‐system according to predefined security policy parameters. The assessment can be agent‐based or agent‐less, and is executed locally by the NAC Gatewayʹs assessment functionality and/or remotely by a pool of assessment servers.

4.Authorization ‐ Once authentication and assessment are complete, the NAC Gateway allocates the appropriate network resources to the end‐system based on authentication and/or assessment results. For Enterasys policy‐enabled edge switches, the NAC Gateway formats information in the RADIUS authentication messages that directs the edge switch to dynamically assign a particular policy to the connecting end‐system. For RFC 3580‐capable edge switches, the NAC Gateway formats information in the RADIUS authentication messages (in the form of RFC 3580 VLAN Tunnel attributes) that directs the edge switch to dynamically assign a particular VLAN to the connecting end‐system. If authentication fails and/or the assessment results indicate a noncompliant end‐system, the NAC Gateway can either deny the end‐system access to the network by sending a RADIUS access reject message to the edge switch, or quarantine the end‐ system by assigning a Quarantine policy or VLAN to the end‐system on the edge switch.

5.Remediation ‐ When the quarantined end user opens a web browser to any web site, its traffic is dynamically redirected to a Remediation web page that describes the compliance violations and provides remediations steps for the user to execute in order to achieve compliance. After taking the appropriate remediation steps, the end user clicks on a button on the web page to reattempt network access, forcing the re‐assessment of the end‐system. At this point, the Enterasys NAC solution transitions the end‐system through the entire NAC cycle of detection, authentication, assessment, and authorization, re‐assessing the security posture of the end‐system to determine if the remediation steps were successfully followed. If the end‐system is now compliant with network security policy, the NAC Gateway authorizes the end‐system with the appropriate policy or VLAN. If the end‐system is not compliant, the end‐system is restricted access to the network and the process starts again.

It is important to note that if the wired edge of the network is non‐intelligent (unmanaged switches and hubs) and is not capable of authenticating and authorizing locally connected end‐ systems, it is possible to augment the network topology to allow implementation of out‐of‐band NAC with the NAC Gateway. This can be accomplished without replacing the physical edge of the network, by adding an intelligent edge switch that possesses specialized authentication and authorization features.

The Enterasys Matrix N‐series switch is capable of authenticating and authorizing numerous end‐ systems connected on a single port through its Multi‐User Authentication (MUA) functionality and may be positioned upstream from non‐intelligent third‐party edge devices to act as the

3-4 Use Scenarios

Page 41 Page 43
Image 42
Page 41 Page 43
Contents Enterasys Page Page Page Contents Design Procedures Use ScenariosDesign Planning Figures TablesPage Intended Audience Related DocumentsGetting Help Support@enterasys.comKey Functionality NAC Solution OverviewAuthentication DetectionAssessment AuthorizationDeployment Models RemediationModel 2 End-System Authorization Model 3 End-System Authorization with AssessmentModel 1 End-system Detection and Tracking NAC Solution Components NAC ApplianceNAC Gateway Appliance NAC Controller ApplianceNAC Controller is available in two models Appliance Comparison NAC Gateway NAC ControllerDisadvantage Advantage NetSight Management NetSight NAC ManagerSummary Radius ServerAssessment Server Summary Summary Overview Model 1 End-System Detection and Tracking ImplementationOut-of-Band NAC Features and Value Inline NAC LayerEnd-System and User Tracking Model 2 End-System Authorization Required and Optional ComponentsInline NAC Location-Based Authorization Device-Based AuthorizationUser-Based Authorization MAC RegistrationComponent Requirements for Authorization Model 3 End-System Authorization with Assessment Inline NAC Extensive Security Posture Compliance Verification Diverse Security Posture Compliance Verification Component Requirements for Authorization with Assessment Implementation Self-Service Remediation Required and Optional Components Enterasys NAC Deployment Models Value Scenario 1 Intelligent Wired Access Edge Use ScenariosPolicy-Enabled Edge NAC FunctionsRFC 3580 Capable Edge VLAN=ProductionScenario 1 Implementation Scenario 2 Intelligent Wireless Access Edge Thin Wireless EdgeRemediation Web User Laptop Thick Wireless Edge Scenario 2 Implementation Scenario 3 Non-intelligent Access Edge Wired and Wireless Layer 2 Wired LAN Scenario 4 VPN Remote Access Scenario 3 ImplementationVPN Remote Access Enterasys Scenario 4 ImplementationUse Scenario Summaries Summary and Appliance Requirements VPN remote access Design Planning Identify the NAC Deployment ModelSurvey the Network Identify the Intelligent Edge of the NetworkNetwork with Intelligent Edge Evaluate Policy/VLAN and Authentication Configuration Case #1 No authentication method is deployed on the networkCase #2 Authentication methods are deployed on the network Overview of Supported Authentication MethodsSupport of Multiple Authentication Methods End-System CapabilitiesSupport for Multiple End-System Connection Authentication Support on Enterasys Devices Authentication ConsiderationsIdentify the Strategic Point for End-System Authorization Thick Wireless Deployments Wired LANWireless LAN Identify Network Connection MethodsRemote Access WAN Thin Wireless DeploymentsSite-to-Site VPN Remote Access VPN Identify Inline or Out-of-band NAC DeploymentSummary Procedures for Out-of-Band and Inline NAC Identify Required NetSight ApplicationsDefine Network Security Domains NAC Configurations Security DomainNAC Configuration Authorization NAC Configuration for a Security Domain Procedures for Out-of-Band and Inline NAC To the network Procedures for Out-of-Band and Inline NAC Procedures for Out-of-Band and Inline NAC Security Domain Configuration Guidelines for Assessment Identify Required MAC and User Overrides MAC OverridesMAC and User Override Configuration Procedures for Out-of-Band and Inline NAC Procedures for Out-of-Band and Inline NAC User Overrides Assessment Design Procedures Determine the Number of Assessment ServersIdentify Assessment Server Configuration Determine Assessment Server LocationOut-of-Band NAC Design Procedures Identify Network Authentication ConfigurationDetermine the Number of NAC Gateways NAC Gateway Redundancy Determine NAC Gateway Location Identify Backend Radius Server Interaction Determine End-System Mobility RestrictionsVlan Configuration Policy Role ConfigurationDefine NAC Access Policies Failsafe Policy and Accept Policy Configuration Assessment Policy and Quarantine Policy ConfigurationPolicy Role Configuration in NetSight Policy Manager Assessment PolicyService for the Assessing Role Quarantine PolicyInline NAC Design Procedures Determine NAC Controller LocationUnregistered Policy Inline NAC Design Procedures Determine the Number of NAC Controllers Layer 2 NAC Controller Redundancy Define Policy Configuration Additional Considerations NAC Deployment With an Intrusion Detection System IDSNAC Deployment With NetSight ASM Additional Considerations Design Procedures
Top Page Image Contents