Designing Access Controls
Lay Out the Network
| The NAC policies you enforce in the wired private zone might be more |
| stringent than those in public zones. Users in the private zone typically have |
| greater access to network resources, so you have more to protect in this zone. |
| The NAC policies also provide opportunities to enforce company policies that |
| might otherwise be ignored. |
| For the endpoint integrity testing method, either the NAC EI agent or the |
| agentless method is suitable. You might choose the agentless method if all |
| endpoints are members of a Windows domain. |
| VLAN Assignment and Other Dynamic Settings. A successfully authen- |
| ticated user is assigned to the user VLAN specified for that user in RADIUS |
| server policies. As you now know, IDM makes it easy to create policies for |
| VLAN assignments and other rights, and these rights can be based on criteria |
| beyond identity. |
| An unauthenticated user is either denied all access or placed on the unauthen- |
| ticated VLAN. |
|
|
N o t e | In an 802.1X environment, unauthenticated users receive access to the unau- |
| thenticated VLAN as soon as they plug into a port. In contrast, unauthenticated |
| users in a |
| ticated VLAN only after failing the authentication process. |
| Choose Switches. As in the public wired zone, the private wired zone |
| |
| features direct wired connections between users and switches, which are the |
| PEPs. For this zone, you should choose a switch that supports 802.1X access |
| and allows dynamic reconfiguration of ports. (See Table |
| If you expect your network to grow, a chassis switch such as the 5300xl or |
| 5400zl is often a good choice. Both of these switches support 802.1X authen- |
| tication and access dynamic settings. |
