Survey the Network
Enterasys NAC Design Guide 4-5
to
locally
authorize
all
MAC
authentication
requests
for
connecting
end
‐
systems,
thereby
not
requiring
a
list
of
known
MAC
addresses.
In
fact,
Enterasys
NAC
can
be
configured
in
a
“learning
mode”
to
dynamically
learn
the
MAC
addresses
of
all
devices
connecting
to
the
network,
permitting
network
access
to
all
of
these
end
‐
systems
for
a
period
of
time.
After
the
MAC
addresses
are
learned,
NAC
can
be
reconfigured
to
permit
access
only
to
these
end
‐
systems,
requiring
all
other
devices
connecting
to
the
network
to
go
through
a
registration
process.
With
MAC
authentication
deployed
on
the
network,
a
backend
RADIUS
server
with
associated
directory
services
is
not
required,
simplifying
the
implementation.
Furthermore,
because
MAC
authentication
only
requires
the
end
‐
system
to
generate
an
Ethernet
packet
onto
the
network,
both
human
‐
centric
and
machine
‐
centric
end
‐
systems
have
the
capability
to
authenticate
to
the
network,
regardless
of
whether
the
end
‐
system
is
a
PC
or
a
printer.
Case #2: Authentication methods are deployed on the network.
If
authentication
is
currently
deployed
on
the
network
with
802.1X,
web
‐
based,
and/or
MAC
authentication,
then
a
RADIUS
server
with
associated
backend
directory
services
must
be
deployed
for
user/device
802.1X
and
web
‐
based
credential
validation.
Moreover,
if
RADIUS
authentication
for
switch
management
logins
is
implemented,
a
RADIUS
server
must
be
deployed
on
the
network.
In
this
scenario,
out
‐
of
‐
band
NAC
is
configured
to
seamlessly
proxy
RADIUS
authentication
requests
received
from
the
switches
at
the
intelligent
edge
of
the
network
to
the
backend
RADIUS
server,
without
requiring
complex
configuration
changes
to
the
RADIUS
server
and
associated
directory
services.
In
addition,
NAC
can
also
be
configured
to
locally
authorize
MAC
authentication
requests.
Overview of Supported Authentication Methods
Following
is
an
overview
of
authentication
methods
supported
by
Enterasys
and
some
third
‐
party
switches,
and
proxied
by
out
‐
of
‐
band
NAC.
802.1X
Authentication
The
IEEE
802.1X
standard
for
port
‐
based
network
access
control,
provides
network
administrators
with
the
ability
to
authenticate
and
authorize
an
end
user
at
the
port
level.
The
802.1X
authentication
method
is
usually
implemented
on
PCs
in
secure
environments
and
requires
that
the
end
‐
system
implement
an
802.1X
supplicant,
which
is
special
software
that
communicates
in
this
protocol.
Because
802.1X
requires
the
input
of
user
credentials,
802.1X
is
normally
used
on
user
‐
centric
end
‐
systems
that
have
a
concept
of
an
associated
user,
such
as
a
PC.
Therefore,
this
authentication
method
may
be
inappropriate
for
machine
‐
centric
devices,
such
as
printers
and
IP
cameras.
However,
newer
software
releases
for
IP
phones
may
include
an
802.1X
supplicant.
Since
Enterasys
NAC
only
acts
as
a
pass
‐
through
to
an
upstream
RADIUS
Server,
it
is
mandatory
that
a
full
authentication
deployment
is
configured
on
the
network
if
802.1X
is
used.
Web
‐
Based
Authentication
Web
‐
based
authentication,
or
Port
Web
Authentication
(PWA),
is
an
authentication
process
that
uses
a
web
browser,
user
‐
login
process
to
gain
access
to
ports.
It
employs
either
CHAP
(Challenge
Handshake
Authentication
Protocol)
or
PAP
(Password
Authentication
Protocol).
Since
web
‐
based
authentication
only
requires
that
a
web
browser
is
on
the
end
‐
system,
it
is
deployed
in
heterogeneous
environments
where
certain
end
‐
systems
may
not
have
an
802.1X
supplicant
installed.
Summary of Contents for 9034385
Page 1: ...Enterasys Network Access Control Design Guide P N 9034385...
Page 2: ......
Page 4: ...ii...
Page 8: ...vi...
Page 22: ...Summary 1 12 Overview...
Page 98: ...Additional Considerations 5 34 Design Procedures...