Manuals / IBM / Computer Equipment / Network Card

IBM Tivoli and Cisco manual

Models: Tivoli and Cisco

1 516

Download 516 pages 58.69 Kb

<>

Install Solution logical block diagram Default network Login Administration Tivoli Configuration Manager Setup wizard welcome window Phased rollout approach Setting the policy version Clean Access Manager CAM

Page 514

Page 513 Page 515

Image 514

IBM Tivoli and Cisco manual

Page 513 Page 515

Related manuals

Manual 516 pages 58.69 Kb

Related pages Troubleshooting for State Industries SUF-60-120 General Specifications for Jet Tools J-3410-2 When the air conditioner is on and in cool/heat mode for Samsung AR12FSFTKWQNZE Frequently Asked Questions for Quadra-Fire 7046-137C Barracuda 9LP Installation Guide, Rev. E for Seagate ST34573N/W/WD/LW/WC/LC Parts list for Graco 1423 Error Code List for Acer 6293 Maintenance Error Codes-Continued for Lucent Technologies 555-670-116 INSTALLATION for Desa CGEFP33NRB FOR YOUR SAFETY READ BEFORE LIGHTING for Vermont Casting D232

Contents

Building a Network Access Control Solution Page International Technical Support Organization Second Edition January Contents Part 2. Customer environment Part 3. Appendixes Index Vii Copyright LicenseIBM TrademarksAIX Preface Team that wrote this redbook Preface Become a published author IBM USComments welcome Page New information January 2007, Second EditionChanged information Page Part 1 Architecture and design Page Business context Security compliance and remediation concept Why we need this Http//banking.senate.gov/conf Does this concept help our mobile users Corporate security policy defined Business driver for corporate security complianceAchievable benefits for being compliant Conclusion Policy Development and AssuranceBusiness context Page Architecting the solution Solution architectures, design, and methodologies Architecture overviewNetwork Admission Control WANPage Security Compliance Manager Page Security policy Tivoli Configuration ManagerArchitectural terminology Compliance queryRemediation handler Compliance User InterfaceNetwork Admission Control process TCM Cisco NAC and Ieee ACSAuthenticator Using Cisco terminologySupplicant Posture agent Network identity provisioningRemediation process Phased rollout approach Definition of a Network Admission Control projectInternet Design process Security compliance management business processArchitecting the solution Security policy life cycle management Creation ImplementationReview and update Solution objectivesEnforcement Default network Network design discussionTrusted network Quarantine accessPerformance controls Implementation flow Scalability and high availabilityPage Conclusion Page Component structure Solution logical block diagram Logical componentsNetwork Admission Control Framework Network Admission ControlPosture validation server CSlog CSMonPolicy enforcement device Admission control clientLogging service Posture plug-inClean Access Agent CAA Clean Access Manager CAMClean Access Server CAS Network Admission Control ApplianceCompliance Clean Access Policy UpdatesCompliance server Administration Compliance reportingCompliance client Posture collector Compliance client logical componentPolicy collector Remediation server Default remediation handlerRemediation Posture cacheNetwork client Physical componentsRemediation handler component Security Compliance Manager client Cisco Trust AgentSecurity Compliance Manager policy Network access device Network access infrastructureIBM Integrated Security Solution for Cisco Networks servers Cisco Secure Access Control ServerSolution data and communication flow Tivoli Configuration Manager serversPolicy creation and deployment flow PolicyComponent structure Posture collection process flow Posture validation and policy enforcement flow Page Remediation flow Secure communication Secure communication between componentsNAC communication Component placementSecurity zones Security Compliance Manager communicationLess Secure Uncontrolled zone Internet, external networks NetworkRestricted zone production network Controlled zone external network-facing DMZControlled zone intranet Restricted zone management networkBranch office compliance Policy enforcement pointsBranch egress enforcement Campus internal enforcement Branch Office Compliance Campus Ingress Enforcement Soho Compliance PAT access protection Small Office Home Office complianceExtranet compliance Extranet ComplianceLab compliance LAB ComplianceData Center protection Data Center ProtectionRemote access protection Remote Access ProtectionPart 2 Customer environment Page Armando Banking Brothers Corporation Company profile Current IT architecture Network infrastructureIBM Integrated Security Solution for Cisco Networks lab Armando Banking Brothers Corporation NAC Appliance Armando Banking Brothers Corporation Page Application security infrastructure Middleware and application infrastructure DMZProject layout and implementation phases Corporate business vision and objectivesProject overview Action Reference Part I Security compliance serverNAC L2 IP NAC L3 IPCCA OOB VG Part III Remediation serverConclusion Page Solution design Page Business requirements Functional requirements Network access control requirementsSecurity compliance requirements Solution functional requirements Remediation requirementsCaused by worms and other hostile software NAC solution conceptual functional requirements Remediation services Security compliance criteriaImplementation architecture AttemptComponent subsystems total solution Logical componentsConfiguring the compliance server Establishing compliance criteriaEstablishing the policy collector parameters Tivoli Security Compliance Manager client componentsSolution design Setting the policy version Maxdataagesecs conceptual flow Setting the remediation handler URL attribute 11 Setting the remediation handler JAR classpath Enforcing compliance criteriaPosture token ACS13 Posture validation policies Page 14 Shared Radius Authorization Components Assigning the System Posture Token Performing remediation Physical components Remediation handler Html pagesCompliance subsystem IBM Security Compliance Manager serverNetwork Admission Control subsystem Access Control ServerIBM Tivoli Security Compliance Manager client Solution design Layer 3 devices NAC-enabled network deviceLayer 2 devices LRECisco Trust Agent Remediation subsystem IBM Tivoli Configuration Manager serverSoftware Package Web Server Conclusion Page Compliance subsystem implementation 125Tivoli Security Compliance Manager setup Installation of DB2 database serverDB2 installation welcome window 127DB2 version selection is presented similar to the one shown Setup wizard welcome window 129License agreement window Installation type selection window 131Installation action selection window Installation folder selection window 133User information dialog Administration contact list dialog 13510 DB2 Instance configuration window 137 11 DB2 Tools selection dialog12 Administrator contact selection window 13 Installation options summary 139Installation of Tivoli Security Compliance Manager server 14 Installation completion window141 15 Language selection dialogDatabase Configuration Administration UtilitiesServer 18 Setup type selection window 14319 E-mail server configuration dialog 20 Server Communication Configuration window 145Server Security Configuration window is displayed, as shown 147 22 Database Location selection window23 Database configuration information 149 24 Database creation choice window25 Administrator User ID Configuration window 26 Installation options summary window 151Configuration of the compliance policies 27 Installation result windowPosture items and posture elements Posture collectors153 Operational Policy collectorPosture collector parameters WorkflowInstallation of posture collectors 15528 Tivoli Security Compliance Manager GUI login 30 Tivoli Security Compliance Manager Administration Console 15732 Import file selection dialog 159 34 Collectors signature validation35 Policy installation summary Customization of compliance policies 16137 Policies view 38 Collectors configuration view 163Versionwf PassversionWarnversions FaillastscanoverWarndefsolderthan 165Defswf Minlenwf WarnminlenunderFailminlenunder Warnmaxageover167 41 Editing collector parametersWarnwindowsnt PasswindowsntPASSWINDOWS2000 169 Failhotfixes WarnhotfixesHotfixwf 171 KEYNovaluerule NokeyruleValue Pass173 Rules Rule operatorsRule format Checking for ZoneAlarm installation directoryRule results 175Checking for Windows XP firewall forced off Reqservice 177Servicedisabledwf ServicerunningwfReqdisabled Reqrunning179 46 Copying an existing compliance query47 Destination policy selection dialog 181 48 Renaming compliance query49 Compliance query description modification 183 50 Violation message modification51 Disabling collector sharing 185 53 Saving changes made to the policy collectorsAssigning the policy to the clients 54 Save policy collectors warning187 55 Create group action selection57 Add policy menu selection Tcmcli utility policy Deploying the client software189 Cisco Trust Agent Prerequisites191 61 Certs directory with CTAInstallation of Cisco Trust Agent on Windows 62 Cisco Trust Agent installation wizard193 63 License agreement for Cisco Trust AgentAccept the defaults -64and click Next 65 Cisco Trust Agent installation type 195Click Next Figure 197 67 Confirmation of the certificate importClick Finish to close the installation, as shown in Figure IBM Tivoli Security Compliance Manager client 199Installation of the Security Compliance Manager client 70 Language selection201 71 The welcome window72 Client Installation Utility window 203 74 Directory selection window 75 Setup type window 205Accept the defaults and click Next Pull207 77 Client connection window78 Server communication configuration window 79 Client Dhcp configuration window 209Next 211 81 Successful completion window82 Security Compliance Manager posture plug-in files Network enforcement subsystem implementation 213Configuring NAC Framework components Configuring the Cisco Secure ACS for NAC L2Installing Cisco Secure ACS 215Configuring the administrative interface to Cisco Secure ACS Interface configuration advanced options 217Allowing administrator access via Http optional Administration controlCisco Secure ACS certificate setup 219Using an ACS self-signed certificate 221 Generating self-signed certificateRestart the Cisco Secure ACS Figure Importing IBM Security Compliance Manager attributes 223Example 7-1 Security Compliance Manager attributes 225 Example 7-2 Import Security Compliance Manager attributeConfiguring logging Click CSV Passed Authentications FigureSelect CSV Failed Authentications Figure 22711 Failed attempts logging Configuring a network device group in Cisco Secure ACS 22913 Interface Configuration screen for the creation of NDGs 231 14 Network Device Group check box15 Network Configuration 233 16 AAA clients17 AAA client setup 235 18 AAA ClientsConfiguring Radius attributes 19 Global Ietf Radius attributesConfiguring groups 23721 Group Setup Configuring users 23923 User-to-Group mappings Click Submit + Restart Global authentication setup241 EAP-FAST configuration Condition EAP-GTC 243EAP-TLS Configuring posture validation 26 Posture Validation245 27 Posture Validation Policies28 CTA Posture Validation Policy 247 29 Posture Validation for CTAClick Add Condition Set Figure 249 31 Adding a condition set32 Posture validation rule creation for CTA check 251 33 CTA rule defined34 Quarantine condition applied as default action 253 35 Completed posture validation for CTAClick Apply and Restart, as shown in Figure 255 37 Repeating the process for Security Compliance Manager38 IBM Tscm policy creation 257 39 IBM Tscm policy creationClick Add Rule to get to the screen shown in Figure 259 41 Tscm policy componentsPage 261 Click Done Figure 263 45 Completed posture validation rulesConfiguring Radius Authorization Components Click Radius Authorization Components265 Ietf47 IOS RAC attribute 267 48 Ietf drop-down menu49 Healthy Sales RAC 269 Tunnel-Medium-Type 802 Click Add Profile Configuring Network Access Profiles271 51 Newly created NAP 52 Authentication configuration for RAC 273From the screen shown in -53,click Add Rule 54 Partial configuration of posture validation 27555 Selecting CTA and Tscm policies An example of the CTA Healthy pop-up is shown in Figure 27758 CTA pop-up configuration 279 59 Completed posture validation for Naciisscn60 Authorization rule creation 281 User group System posture token Shared RAC62 Completed Authorization RAC configuration RACUnknown user policy Configuring the Cisco Secure ACS for NAC L2/L3 IPExternal User Database Clientless userDownloadable Access Control Lists 63 Downloadable ACL creation285 64 Naming of ACLEnter the name of the ACL and the ACL definition Figure Select Radius Authorization Components 287Vendor Attribute Value Click Add Rule 28968 L2IP Healthy Authorization rule Click Apply and Restart Deployment of the network infrastructure291 Configuring Cisco 3750 switch for NAC L2 293 Page Configuring Cisco 3750 switch for NAC L2 IP 295Page Has been applied to the switchport 297Configuring Cisco IOS Router for NAC L3 IP No URL Redirect299 Page 301 Example 7-3 Output of show eou and show eou all command Verifying Network Admission ControlConfiguring NAC Appliance components 303Installing CCA Agent 71 Installation wizard72 Default install directory 305Configuring a CCA OOB VG server CCA version Required ports75 CAM login 307Clean Access Summary window will be displayed Figure 309 77 Device ManagementClick Add Clean Access Server 78 Adding a new CAS311 79 Successful CAS addition80 CAS Status screen 313 81 Network IP screenSelect Advanced → Vlan Mapping 82 Managed subnetsClick Administration → User Pages → Login Configure default login315 Configuring a Switch Group Select Switch Management → Profiles → Group → New85 Switch Group creation 317Verify your new switch group Figure Configuring a switch profile 319Configuring Port Profile 88 Switch profileSelect Switch Management → Profiles → Port → New Figure 32190 Managed profile creation Click Switch Management → Profiles → Snmp Receiver Configuring Snmp receiver323 Adding a managed switch Select Switch Management → Devices → Switches → New93 Manually adding a switch to be managed 325As seen in -94,click the Ports icon Click User Management → User Roles → New Roles Defining user roles327 Click Save Role when completed Click User Management → User Roles → Traffic Control → IP Creating traffic policies329 98 Rules for trusted to untrusted Click Add Policy ActionAllow StateEnabled CategoryIP ProtocolTCP331 Creating local users Click User Management → Local Users → New Local UserClick Create User 333Configure Clean Access Agent 102 List of local usersClick Add Check 335104 CCA version compliance check 337 105 Rules check list checkOperating System Rule NameRule Description Rule Expression339 107 CCA Compliance rule definitionNewly defined rules will be displayed Figure Click Add Requirement Click Requirements → New Requirements Figure341 110 CCA Agent update Click Requirement Rules 343Click Role-Requirements 112 CCA Compliance Requirement rule345 113 Role requirementsDiscovered clients 114 Viewing online usersLogging on as a client 347Click Continue 117 Web page pop-up informing user about non-compliance118 Temporary access notification 349120 Security Compliance Manager Compliance Report window 351 Configuring Cisco 3750 switch for NAC Appliance 123 Successful loginExample of interface configuration for CAM interface 353Example of Snmp configuration Remediation subsystem implementation 355Page Automated remediation enablement 357Remediation server software setup PrerequisitesTivoli Configuration Manager Web Gateway setup Tivoli Configuration Manager359 Installation of the DB2 database Preparing for the installationInstallation of Web infrastructure 361 WebSphere Application Server launchpadWebSphere Installation Wizard window 363 Software License Agreement windowInstallation type selection 365 Component selection dialogDestination folder selection window 367 Node name selection windowRun as a service selection window Installation options summary 36910 Online registration dialog Patching WebSphere Application Server installation 37112 WebSphere product location 13 Installation option selection 373Creating the necessary user account 14 Fix packs directory locationInstallation of Tivoli Configuration Manager Web Gateway 375Welcome window is presented -16. Click Next 377 17 License agreement window18 Component selection 19 Installation directory selection window 37920 Database configuration window 21 Web infrastructure configuration window 38122 Endpoint configuration window 23 Secure access configuration 38324 Summary of installation options Configuration of the remediation server 385Installation of Software Package Web Server 26 WebSphere administrative console login 38727 Install new application 28 Preparing for the application installation 38929 Installation option summary dialog 30 Installation status window 39131 Saving the configuration changes Configuration of the Software Package Web Server 393Installation of the Software Package Utilities 395 Cd %BINDIR% Cd tcmremed\cfg Sputilinitialsetup.bat Creating remediation instructions for the users 397Locating Html 399 33 Directory structure for Html pagesBase Html DefaultlangPosture item Html Html pages example 401Variables and variable tags Posture element HtmlField Tag Wfattribute tag403 Remattribute tag Fail405 \PROGRA~1\IBM\SCDebug attributes Logging available attributesLogging posture items 407Logging the Html search path Creating Html pages for Abbc policy 409Example 8-4shows the Html source code for this Example 8-5 Content of style definition file 411Page Example 8-6 Html source for password length policy details 413Wfattributecurrentvalues.brbWARNING fieldmsg/bbr Example 8-7shows the Html source for 415Page Building the remediation workflows 417TCRNavScan workflow Example 8-8 Content of NavScanMessageen.wsf 419Example 8-9 Content of Sample.properties file for TCRNavScan 421 38 Remediation handler interface with the warning TCRNavVirusDefUpdate 423Page TCRNavSoftwareInstalled 425TCRMSPatchesInstallWinXP 427 HotfixId=KB896423 TmfWebUIEndpoint=tcmweb TCRMSServicePackInstallWinXpSp2 429Page 431 AddRegistryValueBeforeExecData.arrayLength=2TCRZLSoftwareInstalled Noreboot 433TCRZLSoftwareRunning TCRMessengerDisabled 435Modification of the remediation packages 437 Page Part 3 Appendixes 439Page Appendix A. Hints and tips 441Deployment overview 443 Appendix A. Hints and tipsTop-level sequence of events Figure A-2 Isscn top-level sequence diagram Security Compliance Manager and NAC compliance subsystem Cisco Trust AgentFigure A-4 Cisco NAC sequence diagram Cisco NAC sequence of eventsFault isolation Appendix A. Hints and tips Security Compliance Manager server and client Tivoli Security Compliance Manager ServerCommunication port usage Summary of default port usageTools and tricks Cisco NACCisco IOS Software switch Cisco IOS Software routerTools and tricks for the client Cisco Secure ACS server40500 NAC Appliance details Cisco NAC Appliance componentsIn-band versus out-of-band NAC Appliance integration Integration design Integration components NAC Appliance AgentTSCMAgent.bat NACApplianceCompliance.entryScheduler Kickrich.htmlInstalling and configuring prototype integration components System path Scheduler.batConsiderations for designing a production solution NAC Appliance ManagerState mapping and scenarios Page Appendix A. Hints and tips Page 43 Sequence of Events for Scenarios #5 and #6 Conclusion Appendix B. Network Admission Control 471Executive summary Benefit of NACDramatically improve network security 473NAC implementation options NAC Appliance 475NAC Framework solution Investment protectionPlanning, designing, and deploying an effective NAC solution 477NAC technology Next stepsNAC Appliance components NAC Framework components 479Page Locating the Web material 481Using the Web material How to use the Web materialOther publications IBM Redbooks483 How to get IBM Redbooks Online resourcesIBM Support and downloads IBM Global Services Help from IBMPage Numerics 487SCM client communication Glba HtmlNAC NADCreation Deployment PPP Sarbanes-Oxley Act URL UDPVlan Page Page Page Building a Network Access Control Solution