HP Access Control Client Software manual Designing Access Controls

Designing Access Controls

Choose RADIUS Servers

As you make your decision, take into consideration the design you have chosen for combining access control components. Clearly, some combina- tions do not work with some architectures. For example, you cannot both integrate all components on PEPs and fully centralize policies. Table 3-66 shows valid choices.

If your answers to the questions below drive you toward an architecture not supported by your component combination, you should return to “Choose Which Devices Will Play the Role of PDP” on page 3-79 and rethink your choice.

Table 3-66. Access Control Architecture Options for Component Combinations

Access Control	Single-Site	Multi-Site	Multi-Site Fully	Multi-Site	Multi-Site Fully
Component		Autonomous	Distributed	Distributed AAA	Centralized
Combination				with Centralized
				Policies
General	X	X	X	X	X
Integrated server	X	X		X
Integrated server/	X	X		X	X
proxy
Turnkey server	X	X		X	X
Integrated server/	X	X		X	X
proxy with turnkey
server
Fully integrated	X	X

Consider your needs and answer these questions:

1.How fully integrated are your sites? Do the same policies apply to every site? Do you have sufficient IT resources to manage policies at each site separately?

If standardizing policies is important to you, you should probably choose the multi-site fully centralized or the multi-site distributed AAA option. The main difference between these two options is that, in the first, RADIUS servers are located centrally and, in the second, RADIUS servers are located at each site.

For the general, integrated server, and integrated server/proxy combina- tions, a directory service at the central location is the credential reposi- tory. For the turnkey server and integrated server/proxy to turnkey server combinations, one or two RADIUS servers at the central site store creden- tials and policies for the entire network. (They would have the IDM agent. See “Add ProCurve IDM” on page 3-98.)

3-85