Designing Access Controls

Finalize Security Policies

Next, create each policy. The exact steps vary, of course, depending on your RADIUS server. In general, you must:

1.Set the conditions by which the RADIUS server matches an authentication request to the policy.

The exact conditions supported depend on your RADIUS server, but they commonly include group membership (in a group defined on the RADIUS server or in a directory), time, and access method (such as wired, wireless, or remote). Often, you define the conditions manually as a certain value for an attribute in a RADIUS access request. Table 3-91lists some such attributes. In the rightmost column, you can enter the correct value for your policy. Of course, most policies will only use one or two conditions.

Table 3-91. RADIUS Attributes in Access Requests

Attribute

Explanation

Value for My Policy 1

Value for My Policy 2

NAS-IP-Address

IP address of the NAS

 

 

 

(switch or AP) that sends the

 

 

 

request

 

 

 

 

 

 

NAS-Port-Type

Protocol by which the user

 

 

 

connects (802.3, 802.11, and

 

 

 

so forth)

 

 

 

 

 

 

NAS-Port-ID

Port—either a physical or a

 

 

 

WLAN—to which the user

 

 

 

connects

 

 

 

 

 

 

Time

Time at which the access

 

 

 

request is sent

 

 

 

 

 

 

2.Select authentication protocols.

You need to choose the protocols (such as CHAP, PEAP, EAP-TTLS, and EAP-TLS) with which the RADIUS server authenticates users. Users’ endpoints must support the same protocol. However, many RADIUS servers allow you to choose multiple authentication protocols, any of which the endpoints can support. Check your server’s documentation for the protocols that it supports.

Remember that on the NAC 800, you do not configure an EAP method. Instead, you select the EAP type on the endpoint, and during the negoti- ation of the EAP method, the NAC 800 detects the EAP type. If the NAC 800 supports the EAP type, it automatically uses it.

You should have already chosen your authentication protocols and EAP methods in earlier steps in the design process. List your selections in Table 3-92.

3-118