HP Access Control Client Software manual Designing Access Controls

Designing Access Controls

Choose RADIUS Servers

The numbered decision points in the tree are discussed in the next few paragraphs.

1.Have you chosen an access control component combination with inte- grated servers?

You must, of course, choose PEPs with that capability. Then answer these questions:

a.Do you store credentials in another directory, such as OpenLDAP or eDirectory?

If you want to use an integrated server, such as the AP 530’s RADIUS server, which cannot bind to a directory, you must add a proxy server such as SBR or a NAC 800. Move to step 2 to choose the server.

b.Do you want to use IDM?

If your integrated server does not support the IDM agent, you must add a proxy server that does. Move to step 2 to choose the server.

c.Do some PEPs (such as switches) not provide an integrated server?

If your integrated server is the Wireless Edge Services Module, its built-in server can receive authentication requests from other PEPs. Otherwise, you should add another proxy server.

If you do not require integrated servers or you need a proxy server, answer the questions below to choose the server.

2.Do you store credentials in Active Directory?

If so, you should generally use IAS, which is designed to synchronize with Active Directory.

3.Do you plan to use MAC-Auth? If not, move to step 4.

If you do, it is recommended that you do not use Microsoft’s IAS with MAC-Auth in a Windows domain for two reasons:

•Using MAC-Auth with IAS requires creation of pseudo-user accounts (consisting of the allowable MAC addresses) on the Active Directory service. This approach pollutes the Active Directory service with unnecessary accounts.

•Adding MAC addresses as pseudo-user accounts in Active Directory can compromise security if configuration is not clean and if users begin using MAC addresses as login credentials.

You can avoid these problems by using the NAC 800 or a third-party

RADIUS server to locally administer MAC addresses and to service the

RADIUS requests coming from the network edge.

3-92