Access Control Concepts

Network Access Control Technologies

Accounting also enables billing; the accounting logs are forwarded to a billing server, and users are charged for the bandwidth and resources they have consumed.

Network Access Control Architecture

Before turning to methods for implementing a network access control solu- tion, let’s consider the roles network devices play. There are many access control technologies; fortunately, the same basic architecture is used for all of them.

Based on definitions in the Internet Engineering Task Force (IETF) standard for policy-based management, this architecture comprises four logical ele- ments:

■Endpoint

■Policy enforcement point (PEP)

■Policy decision point (PDP)

■Policy repository

(See Request for Comments [RFC] 3084 and 3198 at http://http://tools.ietf.org/ html/.)

Endpoint

The endpoint is the entity attempting to gain access to the network. Usually a computer (workstation or laptop) or personal digital assistant (PDA), the endpoint can also be a printer, scanner, or any device with a network interface card (NIC).

N o t e

Endpoints are sometimes called stations or clients. This guide will always use

 

the term endpoint to avoid confusion.

 

 

Policy Enforcement Point (PEP)

Acting as the gatekeeper to the network, the PEP enforces access control on the endpoint, typically at the endpoint’s point of access. Thus, the PEP is often a switch or wireless Access Point (AP) at the edge of the network. It can also be a device such as the Wireless Edge Services Module, which controls several coordinated (or lightweight) APs, which ProCurve refers to as radio ports (RPs). In this case, the module is the logical point of access because the RPs encapsulate and forward all traffic to it.

1-11