Access Control Concepts
ProCurve NAC 800
Process for 802.1X Quarantining. The NAC 800 imposes this process to control a user’s (and his or her endpoint’s) network access:
1.The endpoint establishes a
•An Ethernet cable is plugged into a switch, and the link opens.
•A wireless endpoint associates with a wireless AP.
2.The PEP shuts down the connection to all traffic except EAP authentication messages. It sends an EAP challenge to the endpoint’s 802.1X supplicant.
3.The endpoint returns an EAP message that typically contains its user- name. The PEP proxies this response to the NAC 800 and the NAC 800’s reply back to the endpoint.
4.The endpoint and the NAC 800 exchange authentication information (proxied by the PEP) as dictated by the EAP method.
5.The NAC 800 verifies the user’s credentials whether against a directory, its own database, or a proxy RADIUS server.
6.If the credentials are correct, the NAC 800 checks other policies to determine the correct authorization rights for the user. One important criterion in the policies is the user’s endpoint integrity posture. In a network with IDM, however, other factors can come into play.
7.Initially, the endpoint integrity posture is Unknown. The NAC 800, which has been configured to associate the Unknown posture with a test VLAN, sends this VLAN assignment to the PEP.