HP Access Control Client Software manual NAC 800 as the Radius Server

Designing Access Controls

Choose RADIUS Servers

NAC 800 as the RADIUS Server

If you decide to use the NAC 800 as the RADIUS server, you must make these choices:

1.Will you use IDM to manage the NAC 800?

ProCurve recommends that you always use IDM to manage a NAC 800 that enforces 802.1X quarantining. IDM enables the NAC 800 to:

•Grant users rights (VLAN assignment, ACLs, rate limits, and quality of service [QoS]) based on endpoint integrity (as well as identity, access time, access location, and WLAN)

•Log activity to a centralized location and easily browsed interface Information tracked includes:

–Lists of successful and failed authentication attempts

–Lists of currently connected users

2.Where will you store credentials?

The NAC 800 can use the following data stores for credentials:

•Its local database (as long as you use IDM to manage the database)

•A directory service (Active Directory, eDirectory, or OpenLDAP)

To choose the NAC 800’s data store, consider the access control combi- nations discussed in “Choose Which Devices Will Play the Role of PDP” on page 3-79. The following ways of combining access control roles apply to a network that uses the NAC 800. In all combinations, the NAC 800 tests endpoint integrity and overrides VLAN assignments for non-compliant endpoints:

•General—The PEPs, PDPs, and credential repositories reside on separate devices. Endpoints connect to switches and APs (PEPs), which send authentication requests to one or more NAC 800s (PDPs). The NAC 800 checks credentials against a directory service and receives policies from its IDM agent.

3-94