HP Access Control Client Software manual NAC 800 as Both a Radius Server and an Endpoint Integrity

Access Control Concepts

ProCurve NAC 800

■ EAP

• PEAP with MS-CHAPv2

• TLS

• TTLS with MD5

• GTC

• LEAP

The NAC 800’s FreeRADIUS server can also log users’ activity and function as an accounting server.

To configure the NAC 800 to provide RADIUS services, you choose the 802.1X deployment and quarantining method. You then prevent the NAC 800 from testing endpoint integrity.

	NAC 800 as Both a RADIUS Server and an Endpoint Integrity
	Solution
	The NAC 800, with its built-in FreeRADIUS server, offers services on both
	network access control fronts. To provide both RADIUS and endpoint integrity
	services, the NAC 800 must be deployed with the 802.1X method.
	The NAC 800 then acts as a PDP that includes these factors in its decisions:
	■ User’s authentication status as determined by its built-in FreeRADIUS
	server
	As described in the section above, the NAC 800 can draw on several
	remote policy repositories to authenticate the user.
N o t e	You can use IDM to manage a NAC 800’s local database as an alternative
	to having the NAC 800 query a remote policy repository such as a
	directory.

■Endpoint integrity posture

If the user authenticates successfully, the NAC 800 decides whether his or her endpoint should receive normal network access or quarantined access. This decision is based on the endpoint’s compliance with NAC policies. After the NAC 800 tests the endpoint, it makes another access decision and assigns the user to the appropriate VLAN.

You can configure the policies for VLAN assignment on the NAC 800 manually. However, IDM offers a quick and efficient way to create the policies. (See “ProCurve IDM” on page 1-58.)

1-53