HP Access Control Client Software manual Public Wired Zone Policies, 133

Designing Access Controls

Lay Out the Network

Remember, in either case, you can allow unauthenticated users to be placed on an unauthenticated VLAN.

Endpoint Integrity. Particularly when you allow members of the public to connect their own equipment to your network, you should implement end- point integrity. The most suitable deployment method is usually DHCP, and the most suitable testing method is ActiveX (because ActiveX testing does not require any installation of software or entering of credentials).

Even if guests use your company’s equipment, you might want to test the equipment’s integrity; otherwise, you cannot be certain guests will not alter security settings and perhaps introduce malware. Because your organization owns the equipment, you can choose the NAC EI agent testing method if you so desire.

Table 3-106. Public Wired Zone Policies

Zone	Authentication	EI Deployment	Testing Method	Authentication	Encryption
	Method			Protocol
Public wired	Web-Auth or	DHCP	NAC EI agent or	RADIUS-CHAP	none
Private equipment	MAC-Auth		ActiveX	RADIUS-PAP
Public wired	Web-Auth	DHCP	ActiveX	RADIUS-CHAP	none
Guest equipment				RADIUS-PAP

Choose Switches. The public wired zone features direct connections between users and switches, which serve as the PEPs. You will need switches that support MAC-Auth and Web-Auth.

Table 3-107 shows the access control methods supported by ProCurve Switches. For example, the ProCurve Switch 3500yl may be a good choice, as it supports both methods and can be reconfigured by the RADIUS server with dynamic settings. For full details on each product, visit http://www.hp.com/ rnd/products/index.htm.

Table 3-107. Network Access Control Capabilities of ProCurve Edge Switches

Switch Series	MAC-Auth	Web-Auth	802.1X	Dynamic VLAN	Dynamic ACLs
				Assignment
5400zl	X	X	X	X	X
5300xl	X	X	X	X	X
4200vl	X	X	X	X
4100gl			X	X
3500yl	X	X	X	X	X

3-133