HP Access Control Client Software manual Dynamic VLANs for PCU

Designing Access Controls

Finalize Security Policies

Table 3-81 shows access profiles and VLAN assignments at PCU. Each access policy group has an associated profile, and some groups have more than one profile. For example, a trusted user, such as the president who accesses the network through an unencrypted wireless connection, requires a different profile from that user on a wired or secure wireless connection. (This profile is called the unencrypted profile).

In this example, profiles that will be associated with the same access policy group are also associated with the same VLAN ID—with the exception of the Quarantine profile. In other words, the president is always placed in the same VLAN no matter how he or she accesses the network. However, the profiles will be associated with different resources.

Table 3-81. Dynamic VLANs for PCU

Access Profile	VLAN ID
IT admin	2
President, vice president, and so on	14
Unencrypted	14
Accounting	15
Registrars	16
Staff	17
Student	18
Engineering students	19
Faculty	20
Engineering faculty	21
Guest	22
Guest_afterhours	22
IP telephones	23
Quarantine/Test	24

■Allowed resources—You should also assign the proper resources to each access profile.

IDM allows you to define resources, which are essentially ACLs. For example, you can create a resource that allows traffic to an email server’s IP address on port 110 and call the resource “Email server.” And you can create a “Web traffic” resource that allows all traffic destined to TCP port 80. You could then assign both resources to an access profile.

3-109