NAC Solution Overview
Enterasys NAC Design Guide 1-3
Model 1: End-system Detection and Tracking
This
NAC
deployment
model
implements
the
detection
piece
of
NAC
functionality.
It
supports
the
ability
to
track
users
and
end
‐
systems
over
time
by
identifying
where
they
are
currently
connected
to
the
network
and
where
they
have
connected
to
the
network
at
any
given
time
in
the
past.
This
information
is
useful
for
compliance
and
auditing
purposes,
as
well
as
other
management
operations
that
require
complete
visibility
into
the
current
and
historical
connections
of
end
‐
systems
and
users.
Model 2: End-System Authorization
This
NAC
deployment
model
implements
the
detection
,
authentication
,
and
authorization
NAC
functionalities,
to
control
access
to
network
resources
based
on
user
and
end
‐
system
identity
and
location.
The
model
supports
MAC
address
or
guest
registration,
where
new
end
‐
systems
are
forced
to
provide
a
valid
user
identity
in
a
web
page
form
before
being
allowed
access
to
the
network.
Following
successful
registration,
end
‐
systems
are
granted
measured
access,
without
requiring
the
intervention
of
network
operations.
Model 3: End-System Authorization with Assessment
This
NAC
deployment
model
implements
the
detection
,
authentication
,
assessment
,
and
authorization
NAC
functionalities,
to
control
access
to
network
resources
based
on
the
security
posture
of
a
connecting
end
‐
system,
as
well
as
user
and
device
identity
and
location.
End
‐
systems
that
fail
assessment
can
be
dynamically
quarantined
with
restrictive
network
access
to
mitigate
the
propagation
of
security
threats
on
the
network,
while
compliant
end
‐
systems
are
permitted
onto
the
network
with
a
measured
level
of
access.
Alternatively,
specific
end
‐
systems
and
users
can
be
assessed
upon
network
connection
and
be
permitted
network
access
regardless
of
the
assessment
results.
This
approach
allows
an
IT
administrator
to
have
visibility
into
the
configuration
of
end
devices
on
the
network
without
impacting
their
network
connectivity
during
or
after
assessment.
This
approach
is
usually
implemented
during
the
initial
rollout
of
the
NAC
solution
for
baselining
purposes.
This
NAC
deployment
model
requires
the
use
of
either
integrated
assessment
server
functionality
or
the
ability
to
connect
to
external
assessment
services,
in
order
to
execute
the
end
‐
system
vulnerability
assessment.
Model 4: End-System Authorization with Assessment and Remediation
This
NAC
deployment
model
implements
the
detection
,
authentication
,
assessment
,
authorization
,
and
remediation
NAC
functionalities,
providing
for
the
quarantine
and
remediation
of
noncompliant
devices.
Assisted
remediation
uses
web
‐
based
notification
to
dynamically
inform
quarantined
end
‐
systems
of
security
compliance
violations,
and
allow
end
users
to
safely
remediate
their
quarantined
end
‐
system
without
impacting
IT
operations.
Содержание 9034385
Страница 1: ...Enterasys Network Access Control Design Guide P N 9034385...
Страница 2: ......
Страница 4: ...ii...
Страница 8: ...vi...
Страница 22: ...Summary 1 12 Overview...
Страница 98: ...Additional Considerations 5 34 Design Procedures...
