Enterasys Networks 9034385 manual Identify Required MAC and User Overrides, MAC Overrides

Procedures for Out-of-Band and Inline NAC

3. Identify Required MAC and User Overrides

MAC and user overrides are used to handle end‐systems that require a different set of authentication, assessment, and authorization parameters from the rest of the end‐systems in a Security Domain. A MAC or user override can be defined within the scope of a specific Security Domain or all Security Domains. An override scoped to a specific Security Domain lets you specify how an end‐system is authenticated, assessed, and authorized whenever the end‐system connects to the network in that particular Security Domain. A global override lets you specify how an end‐system is authenticated, assessed, and authorized whenever the end‐system connects to any Security Domain on the network.

Use the network scenarios and examples provided in this section to determine what MAC and user overrides are required for your NAC deployment.

MAC Overrides

A MAC override lets you create a configuration for a single end‐system (based on a full MAC address) or for a group of end‐systems (based on a MAC OUI, a MAC OUI Group or a Custom MAC Mask). For example, you could create a MAC override that allocates VoIP services to certain IP phones based on a MAC OUI group. Or, you could deny a specific end‐system by creating a MAC override that quarantines the MAC address of that end‐system and restricts its network access.

5-12 Design Procedures