Enterasys Networks 9034385 manual Scenario 3 Non-intelligent Access Edge Wired and Wireless

Scenario 3: Non-intelligent Access Edge (Wired and Wireless)

It is important to note that if the wireless edge of the network is non‐intelligent and not capable of authenticating and authorizing wireless end‐systems, it is possible to augment the network topology to implement out‐of‐band NAC with the NAC Gateway. This can be accomplished without replacing the physical edge of the network, by adding an intelligent edge switch that possesses specialized authentication and authorization features.

The Enterasys Matrix N‐series switch is capable of authenticating and authorizing numerous end‐ systems connected on a single port through Multi‐User Authentication (MUA), and may be positioned upstream from non‐intelligent third‐party wireless APs to act as the intelligent edge on the network. The Enterasys Matrix N‐series switch is capable of authenticating and authorizing over 1000 end‐systems uplinked to a single Matrix N‐series port from an AP, a set of APs, or wireless switches. In this configuration, the Matrix N‐series acts as the intelligent edge switch on the network, although not physically located on the access edge. By provisioning access to network resources on the Matrix N‐series via MUA, end‐system traffic destined to adjacent switches on the network can be securely contained at the Matrix N‐series port.

Scenario 3: Non-intelligent Access Edge (Wired and Wireless)

In the non‐intelligent access edge use scenario, the edge switches and access points that compose the network access layer are not capable of authenticating and authorizing the connecting end‐ systems on the network.

In this scenario, inline NAC is implemented by positioning the NAC Controller at a strategic point in the network topology, as the authorization point for end‐system traffic enforcement.

The NAC Controller may be positioned directly within the VLAN where end‐systems are connected or across one or more routed boundaries. When the NAC Controller is positioned within the VLAN where end‐systems are connected, each device is uniquely identified by its associated MAC address. When the NAC Controller is positioned across a routed boundary (for example, behind a WAN router located in an enterpriseʹs central site), each end‐system is identified by its associated IP address.

The following figure illustrates how the NAC Controller and the other Enterasys NAC components work together in the non‐intelligent edge to provide network access control.

Enterasys NAC Design Guide 3-9