manualshive.com logo in svg

Enterasys 9034385, Design Manual, Page: 41 / 98

Share
Download
Enterasys 9034385 Design Manual Download Page 41

Scenario 1: Intelligent Wired Access Edge

Enterasys NAC Design Guide 3-3

RFC 3580 Capable Edge

In

 

this

 

figure

 

the

 

NAC

 

Gateway

 

and

 

the

 

other

 

Enterasys

 

NAC

 

components

 

provide

 

network

 

access

 

control

 

for

 

a

 

network

 

with

 

third

‐

party

 

switches

 

that

 

support

 

RFC

 

3580.

Figure 3-2  Intelligent Wired Access Edge with RFC 3580 Capable Devices

1

4

3

2

3

5

5

Remediation

Web Page

3

Enterasys

NAC Manager

3rd Party Switch

(RFC 3850-compliant)

NAC Gateway

(out-of-band appliance)

Assessment

Server

Authentication

Server

(optionally integrated

in NAC Gateway)

VLAN=

Quarantine

VLAN=

Production

1

2

3

4

5

NAC Functions

Detect

Authenticate

Assess

Authorize

Remediate

Summary of Contents for 9034385

Page 1: ...Enterasys Network Access Control Design Guide P N 9034385...

Page 2: ......

Page 3: ...B SITE OR THE INFORMATION CONTAINED IN THEM EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF KNEW OF OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES Enterasys Networks Inc 50 Minuteman Road Ando...

Page 4: ...ii...

Page 5: ...t Models Model 1 End System Detection and Tracking 2 1 Implementation 2 1 Out of Band NAC 2 1 Inline NAC Layer 2 2 2 Inline NAC Layer 3 2 2 Features and Value 2 2 Required and Optional Components 2 3...

Page 6: ...d LAN 4 9 Wireless LAN 4 9 Remote Access WAN 4 10 Site to Site VPN 4 10 Remote Access VPN 4 11 Identify Inline or Out of band NAC Deployment 4 11 Summary 4 11 Chapter 5 Design Procedures Procedures fo...

Page 7: ...4 5 1 Security Domain 5 3 5 2 NAC Configuration 5 4 5 3 NAC Configuration for a Security Domain 5 6 5 4 MAC and User Override Configuration 5 13 5 5 NAC Gateway Redundancy 5 21 5 6 Policy Role Configu...

Page 8: ...vi...

Page 9: ...de provides product descriptions and installation instructions for the NAC Controller NAC Gateway Appliance Installation Guide for the installation of the Enterasys NAC Gateway SNS TAG HPA and SNS TAG...

Page 10: ...g Enterasys Networks for technical support have the following data ready Your Enterasys Networks service contract number A description of the failure A description of any action s already taken to res...

Page 11: ...etwork For end systems which are not compliant with defined security guidelines the NAC solution provides assisted remediation allowing end users to perform self service repair steps specific to the d...

Page 12: ...a captive portal email notification pop up messages and messenger service integration among others The remediation process includes updating the device to meet corporate security requirements for exa...

Page 13: ...esources based on the security posture of a connecting end system as well as user and device identity and location End systems that fail assessment can be dynamically quarantined with restrictive netw...

Page 14: ...eir end systems have been quarantined due to network security policy non compliance and allows end users to safely remediate their end systems without assistance from IT operations Table 1 1 Component...

Page 15: ...provides integrated assessment servers A separate license is required for integrated assessment This integrated NAC Gateway supports both agent less network based and agent based assessment In additio...

Page 16: ...ontroller is positioned before the first routed boundary for connecting end systems closer to the access edge of the network the Layer 2 NAC Controller mode is utilized In this mode of operation the N...

Page 17: ...e network Assessment Assessment can be implemented using localized integrated agent based and or agent less assessment1 or external agent based and or agent less assessment using a bank of external as...

Page 18: ...omplex because the NAC Gateway requires that an authentication method is deployed on the network and that the authenticating access edge switches are capable of dynamically authorizing end systems bas...

Page 19: ...larity Advantage The NAC Gateway is always aware of the MAC address of the device connecting to the network and its associated IP address username and location switch IP address and port Therefore NAC...

Page 20: ...component of the NAC solution providing comprehensive network inventory and change management capabilities for your network infrastructure RADIUS Server A RADIUS server with backend directory service...

Page 21: ...quarantined end system without impacting IT operations Enterasys offers two types of NAC appliances The NAC Gateway appliance implements out of band network access control and requires the implementat...

Page 22: ...Summary 1 12 Overview...

Page 23: ...users connected to the network in order to profile and enumerate the assets on the enterprise network It is important to note that in this model the NAC solution does not play a part in authorizing a...

Page 24: ...atures and Value There are two key pieces of functionality and value propositions supported by Model 1 End System and User Tracking Model 1 supports the ability to track end systems by MAC address as...

Page 25: ...being assessed for security posture compliance when connecting to the network A RADIUS server is only required if out of band network access control using the NAC Gateway or inline network access cont...

Page 26: ...ources to the end system based on device identity user identity and location For Enterasys policy enabled edge switches the NAC Gateway formats information in the RADIUS authentication messages that d...

Page 27: ...cific location such as behind a firewall or on a particular VLAN for security reasons Physically moving the connection of these devices to an open area of the network increases the risk of these devic...

Page 28: ...is user connects to the network In contrast a user in the IT operations group or a technician sent to repair a device on the network may be permitted unrestricted access to network resources for troub...

Page 29: ...from any location enterprise wide If ASM reverses the quarantine action it notifies NAC Manager and the quarantine is automatically removed and the end system is dynamically re admitted access to net...

Page 30: ...to quarantine end systems that fail assessment In fact during the initial rollout of NAC on the enterprise network it is highly recommended that end systems are not restricted access to the network i...

Page 31: ...system the NAC Gateway can either deny the end system access to the network by sending a RADIUS access reject message to the edge switch or quarantine the end system with a highly restrictive set of...

Page 32: ...lnerabilities present in services running on unpatched laptops are appropriately remediated so that attacks that target those vulnerabilities are not successful if they reach the device on the network...

Page 33: ...veral reasons why both assessment models are critical to a complete NAC solution Security agents loaded onto managed end systems offer extensive assessment capabilities If an agent is required a new e...

Page 34: ...licy Manager provides the ability to centrally define and configure the authorization levels or policies NetSight Inventory Manager is an optional component providing comprehensive network inventory a...

Page 35: ...ng way Detection As described in Model 2 Authentication As described in Model 2 Assessment As described in Model 3 Authorization As described in Model 3 Remediation When end systems are quarantined by...

Page 36: ...access needed services With the Enterasys NAC solution network based notification and remediation are integrated Once an end system is put into a quarantine state notification is achieved by redirect...

Page 37: ...ware application used to monitor the health and status of infrastructure devices in the network including switches routers and Enterasys NAC appliances NAC Gateways and NAC Controllers Assessment func...

Page 38: ...End System Authorization In addition to the values from Model 1 Location based authorization using Security Domains and Lock MAC features Special handling of end systems or users with MAC User overrid...

Page 39: ...ssignment as defined in RFC 3580 Scenario 1 Intelligent Wired Access Edge In the intelligent wired access edge use scenario the edge switches that compose the network access layer are capable of provi...

Page 40: ...sys NAC components work together in a network with policy enabled edge switches to provide a comprehensive NAC solution Figure 3 1 Intelligent Wired Access Edge with Enterasys Policy Enabled Devices 1...

Page 41: ...d party switches that support RFC 3580 Figure 3 2 Intelligent Wired Access Edge with RFC 3580 Capable Devices 1 4 3 2 3 5 5 Remediation Web Page 3 Enterasys NAC Manager 3rd Party Switch RFC 3850 compl...

Page 42: ...0 VLAN Tunnel attributes that directs the edge switch to dynamically assign a particular VLAN to the connecting end system If authentication fails and or the assessment results indicate a noncompliant...

Page 43: ...securely contained with policy at the Matrix N series port Scenario 2 Intelligent Wireless Access Edge In the intelligent wireless access edge use scenario thick Access Points APs or wireless switche...

Page 44: ...less Access Point 5 3 Enterasys NAC Manager Intelligent Wireless Controller RFC 3850 compliant NAC Gateway out of band appliance Assessment Server Authentication Server optionally integrated in NAC Ga...

Page 45: ...ng on the functionality supported by the APs The following figure illustrates how the NAC Gateway and the other Enterasys NAC components provide network access control in a thick wireless deployment F...

Page 46: ...sults For Enterasys policy enabled wireless switches and access points the NAC Gateway formats information in the RADIUS authentication messages that directs the edge switch to dynamically assign a pa...

Page 47: ...cated on the access edge By provisioning access to network resources on the Matrix N series via MUA end system traffic destined to adjacent switches on the network can be securely contained at the Mat...

Page 48: ...inline appliance Assessment Server Authentication Server optionally integrated in NAC Controller Role Quarantine Layer 3 Wired LAN Role Quarantine Role Quarantine Layer 2 Wired LAN Layer 2 Wireless L...

Page 49: ...ning a policy to traffic sourced from this end system If authentication fails and or the assessment results indicate a noncompliant end system the NAC Controller can either deny the end system access...

Page 50: ...of the end system according to predefined security policy parameters The assessment can be agent based or agent less and is executed locally by the NAC Controller s assessment functionality and or rem...

Page 51: ...summarizes four NAC use scenarios and their NAC appliance requirements The Enterasys NAC solution is capable of implementing network access control for all four use scenarios as well as environments w...

Page 52: ...remote access VPN tunnels into the enterprise network Appliance Requirement NAC Controller Inline network access control is implemented by deploying the NAC Controller appliance to locally authorize c...

Page 53: ...maintained over time for each device on the network yielding complete historical information about a device as it interacts with the network Model 2 End System Authorization Enterasys NAC detects auth...

Page 54: ...and authorization of connecting end systems The NAC Gateway effects the assignment of policies or VLANs on Enterasys switches or RFC 3580 capable switches located at edge of the network to authorize...

Page 55: ...d party are also part of the intelligent edge of the network because they are able to authenticate and authorize connecting end systems with a particular level of network access using dynamic VLAN ass...

Page 56: ...entication Configuration For a network with an intelligent edge the second step in surveying your network is to evaluate the network authentication method currently being used and how the deployment o...

Page 57: ...backend RADIUS server without requiring complex configuration changes to the RADIUS server and associated directory services In addition NAC can also be configured to locally authorize MAC authenticat...

Page 58: ...bilities When authentication is configured on the network it is important to consider end system capabilities and their ability to interact with the authentication process Machine centric end systems...

Page 59: ...entication and authorization of over 2000 users and devices per port providing the highest degree of authentication method configuration flexibility The SecureStack C2 C3 and B2 B3 User IP Phone authe...

Page 60: ...f band NAC using the NAC Gateway appliance leverages policy on Enterasys switches to securely authorize connecting end systems RFC 3580 capable switches can be used for authentication and authorizatio...

Page 61: ...ually authenticating and uniquely authorizing multiple devices connected to a single port Most of the security benefits of out of band NAC using Enterasys policy can be obtained by implementing author...

Page 62: ...for remote users If the NAC Gateway is implemented at the main site then it is important to consider what impact a WAN link disconnection would have on the NAC process and remote end system connectivi...

Page 63: ...ent requirements 1 Identify the intelligent edge in your network if it exists This information will be used to help you select which NAC appliance the NAC Gateway or NAC Controller best suits your net...

Page 64: ...ms If the network infrastructure does not contain intelligent devices at the edge or distribution layer then inline NAC using the NAC Controller as the authorization point for connecting end systems m...

Page 65: ...C Manager is a plugin application to NetSight Console it is necessary to have NetSight Console installed on a server with NAC Manager NetSight Console is used to monitor the health and status of devic...

Page 66: ...or each area of the network that has its own unique requirements for end system authentication assessment and authorization A Security Domain defines a set of NAC Gateways and NAC Controllers that hav...

Page 67: ...default NAC configuration that defines the authentication assessment and authorization parameters for all end systems connecting in that domain A Security Domain can also include MAC or user override...

Page 68: ...on file that determines end system compliance with the SANS Top 20 vulnerabilities The same Nessus server can be used to assess Windows machines for Windows related vulnerabilities and also assess MAC...

Page 69: ...he network a scoring override can be configured to associate a high risk score if Wireshark is detected on an end system Which end systems are quarantined NAC Manager uses risk levels to determine whe...

Page 70: ...AC 5 6 Design Procedures The following figure shows the NAC Manager window used to create or edit a NAC Configuration and define its authentication assessment and authorization attributes Figure 5 3 N...

Page 71: ...of RADIUS authentication requests to a RADIUS server If the RADIUS server returns a policy or VLAN based on user or end system identity uncheck Replace RADIUS Attributes with Accept Policy Otherwise...

Page 72: ...rk These measures limit the network exposure to security threat propagation and protect against network instability In NAC Manager create a Security Domain with the following configuration attributes...

Page 73: ...xy RADIUS Request to a RADIUS Server radio button selected check the Replace RADIUS Attributes with Accept Policy option and specify a non restrictive policy or VLAN in the Accept Policy field This al...

Page 74: ...e mail servers web servers or PCs running a specific OS Microsoft 2003 Server Microsoft XP RedHat Linux MAC OS This requires that the Security Domain be associated to an Assessment Configuration that...

Page 75: ...ng attribute The Use Assessment Policy While Assessing checkbox is not selected In this case NAC Manager assigns the policy or VLAN returned from the RADIUS server or the locally defined Accept Policy...

Page 76: ...cular Security Domain A global override lets you specify how an end system is authenticated assessed and authorized whenever the end system connects to any Security Domain on the network Use the netwo...

Page 77: ...3 The following figure displays the windows used for MAC and user override configuration in NAC Manager Notice that either an existing NAC Configuration can be used or a custom configuration can be sp...

Page 78: ...all Security Domains for the MAC override scope For the assessment authentication and authorization configuration choose a NAC Configuration or specify a custom configuration with the following parame...

Page 79: ...rize MAC Authentication Requests Locally so MAC authentication attempts by these devices are assigned the Accept Policy Check Replace RADIUS Policy with Accept Policy so the policy information returne...

Page 80: ...access It is important to note that the Layer 3 NAC Controller may not determine the true MAC address of the downstream connected end system In this case a MAC override configured in NAC A device or...

Page 81: ...ssessment servers added for load balancing and scalability purposes The same assessment server can be used for multiple Security Domains and each assessment server can assess end systems using differe...

Page 82: ...uration An assessment server utilizes third party assessing software to execute scans against connecting end systems and this software must be locally configured with the security assessment parameter...

Page 83: ...AC authentication The types of users connecting to the network It is necessary to understand how authentication affects the different type of users connecting to the network and what implications this...

Page 84: ...TAG ITA appliances then the formula would be 9000 3000 3 required ITA appliances For each switch in a particular Security Domain the maximum number of authenticating end systems that may be connected...

Page 85: ...ng the secondary NAC Gateway is the same model as the primary The secondary NAC Gateway is not configured as a primary NAC Gateway for any switch on the network and therefore is inactive until a prima...

Page 86: ...y to the NAC Gateway over UDP IP and the NAC Gateway in turn communicates to a backend RADIUS server Therefore the only requirement for NAC Gateway placement is that a routable IP forwarding path exis...

Page 87: ...on of user device network login credentials on the network If 802 1X web based or RADIUS authentication for switch management logins is implemented a RADIUS server with backend directory services must...

Page 88: ...e NAC is deployed on the network each Enterasys switch in the intelligent edge of the network must be configured with the appropriate policy roles that may be returned from the NAC Gateways A list of...

Page 89: ...locally by the NAC Gateway and when an end system has passed an assessment if an assessment was required or if the Accept Policy has been configured to replace the Filter ID information returned in t...

Page 90: ...server will not detect the FTP vulnerabilities on the end system To achieve this trade off the Assessing policy role can be configured by default to deny all traffic and be associated to classificatio...

Page 91: ...es are configured to allow access to the appropriate network resources for communication with the assessment servers during assessment This can be implemented by associating the Assessing service show...

Page 92: ...re with steps specifically relating to the implementation of inline NAC with the NAC Controller 1 Determine NAC Controller Location Because the NAC Controller is placed inline with traffic sourced fro...

Page 93: ...it should be understood that some advantages exist with the deployment of a Layer 2 NAC Controller over a Layer 3 NAC Controller which may affect the decision of how NAC Controllers are positioned Whi...

Page 94: ...ed NAC Controllers of that type per Security Domain The configuration of NAC Controller redundancy To achieve redundancy at each location in the network where the NAC Controller is positioned an addit...

Page 95: ...are positioned on either side of the NAC Controllers Redundant Layer 3 NAC Controllers are active active in that traffic from a downstream router may pass through either of the redundant Layer 3 NAC...

Page 96: ...n be selected as the Failsafe Policy in the NAC Configuration The Enterprise User policy role is fairly open permitting most types of communication onto the network For security purposes the Enterpris...

Page 97: ...rking environments with IDS technologies that detect real time security events on the network While end system assessment determines the security posture of connecting devices and mitigates threats po...

Page 98: ...Additional Considerations 5 34 Design Procedures...

Reviews:

No comments