HP Access Control Client Software manual Design NAC Policies

Designing Access Controls

Finalize Security Policies

■ Workgroups—Set the appropriate NetBios names in each policy in the group.

■ User groups (or any other criteria used by IDM)—IDM gives you the opportunity to apply different NAC policies according to any criteria used by IDM to differentiate network access. You simply create rules that place endpoints to be tested in different VLANs. For example, follow these steps to apply different policies to different user groups:

a. Instead of creating a single test access profile and a single quarantine access profile (as explained in “Access Group Policies with IDM” on page 3-107), create different test and quarantine profiles for different user groups.

b. Set different VLAN IDs in each profile.

c. In each access policy group, create a rule that matches Unknown, Quarantine, and Infected postures to the appropriate test and quar- antine profiles. Now, unknown and quarantined endpoints receive different VLAN assignments (and IP addresses on different subnets) according to the users’ group.

d. Match each NAC policy to the appropriate subnet addresses. Because an endpoint might be tested in a test VLAN (Unknown posture, pre- connect testing), quarantine VLAN (Quarantine posture, pre-connect retesting), or normal user VLAN (Healthy posture, post-connect test- ing), you should specify the IP addresses for each of the subnets corresponding to those VLANs.

	Design NAC Policies
	Chapter 2: “Customer Needs Assessment” and “Comprehensive Security Pol-
	icy” on page 3-5 helped you to define your security policies for endpoints. Now
	you must translate those policies into NAC policies.
	The sections below help you list the tests required to make your NAC policies
	enforce your security policies.
N o t e	The NAC 800 comes pre-configured with three NAC policies (low, medium,
	and high). Before configuring a new policy, check whether one of these
	policies is suitable for your system.
	Tests for Minimal Endpoint Integrity. All endpoints should be free of
	malware and have all current patches. These minimal requirements ensure
	that endpoints are not currently infected and are also protected against known
	vulnerabilities.

3-121