Access Control Concepts

 

 

 

Network Access Control Technologies

 

 

N o t e

The NAC 800 allows endpoints to automatically download the NAC EI agent

 

the first time that they are tested—combining the ease of deployment of the

 

a transient agent with the advantages of a permanent agent. However, the

 

automatic download requires ActiveX.

 

■ Transient-agentbased—Web browser with ActiveX and JavaScript

 

 

allowed in the security settings

 

Web browsers implement security in slightly different ways. Most Web

 

browsers allow you to set up different settings for different Web sites. For

 

example, the Web browser might generally prohibit ActiveX but allow it

 

for the network access controller. The ProCurve Access Control Solutions

 

Implementation Guide shows you how to set up various Web browsers.

 

■ Agentless—application such as:

 

•

WMI

 

 

These Microsoft Windows OSs support WMI:

 

 

–

Windows 2000

 

 

–

Windows ME

 

 

–

Windows Server 2003

 

 

–

Windows XP

 

•

SNMP agent

 

•

RPC

 

 

All Windows OSs (Windows 95 and later) support RPC. The network

 

 

access controller must know administrator credentials for the end-

 

 

point to successfully make use of RPC.

In addition, the endpoint’s security settings most not interfere with testing. In practice, this usually means that you must open ports in personal firewalls or other firewalls that stand between the endpoint and the network access controller. Often, however, agents will automatically open the correct ports without user interaction.

For example, the NAC 800 agent uses TCP and UDP ports 1500, and the agent automatically opens these ports on all personal firewalls (except a non- Windows firewall on an XP endpoint). However, you must open these ports on a router firewall manually.

1-41