Designing Access Controls

Choose RADIUS Servers

As you make your decision, take into consideration the design you have chosen for combining access control components. Clearly, some combinations do not work with some architectures. For example, you cannot both integrate all components on PEPs and fully centralize policies. Table 3-66shows valid choices.

If your answers to the questions below drive you toward an architecture not supported by your component combination, you should return to “Choose Which Devices Will Play the Role of PDP” on page 3-79and rethink your choice.

Table 3-66. Access Control Architecture Options for Component Combinations

Access Control

Single-Site

Multi-Site

Multi-Site Fully

Multi-Site

Multi-Site Fully

Component

 

Autonomous

Distributed

Distributed AAA

Centralized

Combination

 

 

 

with Centralized

 

 

 

 

 

Policies

 

General

X

X

X

X

X

Integrated server

X

X

 

X

 

Integrated server/

X

X

 

X

X

proxy

 

 

 

 

 

Turnkey server

X

X

 

X

X

Integrated server/

X

X

 

X

X

proxy with turnkey

 

 

 

 

 

server

 

 

 

 

 

Fully integrated

X

X

 

 

 

 

 

 

 

 

 

Consider your needs and answer these questions:

1.How fully integrated are your sites? Do the same policies apply to every site? Do you have sufficient IT resources to manage policies at each site separately?

If standardizing policies is important to you, you should probably choose the multi-site fully centralized or the multi-site distributed AAA option. The main difference between these two options is that, in the first, RADIUS servers are located centrally and, in the second, RADIUS servers are located at each site.

For the general, integrated server, and integrated server/proxy combina- tions, a directory service at the central location is the credential reposi- tory. For the turnkey server and integrated server/proxy to turnkey server combinations, one or two RADIUS servers at the central site store creden- tials and policies for the entire network. (They would have the IDM agent. See “Add ProCurve IDM” on page 3-98.)

3-85