HP Access Control Client Software manual Access Control Rights-Dynamic Settings, VLANs

Access Control Concepts

Network Access Control Technologies

Access Control Rights—Dynamic Settings

The overview of “Authorization” on page 1-8 gave a few examples of how rights are assigned and enforced. Let’s now look in more detail at ways to control users’ access after they connect.

Keep in mind that you can set up these access controls in one of two ways:

■Manually

■Dynamically as a part of the AAA architecture—This guide will focus on this option.

VLANs

VLANs divide users and other network devices into separate Layer 2 broadcast domains, each isolated and relatively secure from the others; they are a fundamental way to group and control users. Traffic cannot cross a VLAN (subnet) boundary unless forwarded by a router, which can filter the traffic appropriately with ACLs.

Traditionally, users are assigned to VLANs statically. That is, each user has a single port at which he or she is expected to remain, and the user’s port is actually assigned to the VLAN. If the user accesses the network through a different port, he or she might be in a different VLAN. And in a wireless network, all users that access the WLAN find themselves in the same VLAN.

The traditional model is no longer adequate for many networks because users access the network through many different ports. For example, although employees often connect to the network from the port at their desk, they might also connect from conference rooms or even a remote location. In addition, an AP, in the revolving-door wireless world, funnels a constantly shifting group of users to a single switch port.

Your access control design and your VLAN design interconnect because the network access control solution helps ports configure themselves for VLANs dynamically. When a user is authorized to connect to the network, he or she is also authorized for the correct VLAN, as determined by the authentication server and enforced by the PEP.

Here is another advantage of dynamic VLANs: you can create rules to assign users to different VLANs under various conditions. For example, you might create one VLAN for users accessing the network during work hours and a different VLAN for after-hours access.

1-33