HP Access Control Client Software manual Vulnerability to Risks and Risk Tolerance

Designing Access Controls

Choose the Endpoint Integrity Deployment Method

Table 3-34. Options for Endpoint Integrity Deployment Method by Access

Control Method

Access Control	Private Wired	Public Wired	Private Wireless		Public Wireless
Method
802.1X	802.1X	802.1X	802.1X		802.1X
802.1X with MAC-Auth	802.1X	802.1X	802.1X		802.1X
for headless devices
MAC-Auth—switches	802.1X	802.1X	802.1X		802.1X
and APs support
dynamic VLANs
MAC-Auth—Switches	DHCP	DHCP	•	DHCP	•	DHCP
and APs do not			•	Sometimes inline	•	Sometimes inline
support dynamic
VLANs
Web-Auth or MAC-	DHCP	DHCP	•	DHCP	•	DHCP
Auth			•	Sometimes inline	•	Sometimes inline

Example

Based solely on the access control method selected in the last step, the PCU network administrators would choose the deployment options shown below.

Table 3-35. Deployment Method by Access Control Method

Factor	Private Wired	Public Wired	Private Wireless	Public Wireless
Selected access control	802.1X	DHCP	802.1X	DHCP
method

Vulnerability to Risks and Risk Tolerance

Each deployment method provides a different level of security, depending on the underlying network configuration. For example, with the inline deploy- ment method all traffic must physically pass through the NAC 800 before it can access the network, which provides a high degree of security.

The 802.1X deployment method also provides a high degree of security because it works in conjunction with the 802.1X access control method. As a result, it is difficult for users to circumvent it.

3-53