HP Access Control Client Software Recording Information about Network Switches, Port Mirroring

Customer Needs Assessment

Evaluate the Existing Network Environment

If you plan to implement endpoint integrity, you should also determine if the switch supports port mirroring, which may be necessary to allow NAC 800s to detect endpoints. (Depending on the switch, this feature might be called port monitoring, local traffic mirroring, or port spanning.) Do any of the switches support remote traffic mirroring, which allows one switch to mirror traffic to another switch? The ProCurve 3500yl, 5400zl, 6200yl, and 8200zl Switches all support this capability. This capability will give you some addi- tional flexibility if you are using the 802.1X deployment method for the NAC 800.

As you begin to record information about the switches, you should identify the switch vendor, model number, and firmware version. For easy reference, you can record each switch’s capabilities in a table such as Table 2-3. The table provides two examples and then some space for you to record information about your company’s switches.

Table 2-3. Recording Information about Network Switches

Switch Vendor and	Firmware	Location	Authentication Methods	Port Mirroring/
Model Number	Version		Supported	Monitoring/
				Spanning
5400zl Switch	K.12.14	North building, area 1	802.1X, local and RADIUS	Remote intelligent
			MAC-Auth, Web-Auth	mirroring
5300xl	E.10.61	North building, area 2	802.1X, local and RADIUS	Port mirroring
			MAC-Auth, Web-Auth

You should also record information about your company’s APs. For example, do the APs on your network support the strongest security for wireless networks—802.1X with Wi-Fi Protected Access (WPA/WPA2)?

Do your switches and APs include an 802.1X supplicant, which allows them to authenticate to the network? This capability helps prevent hackers or even well-meaning employees from attaching a rogue AP to the network. (See Figure 2-3.)

2-26