Scenario 1: Intelligent Wired Access Edge
3-4 Use Scenarios
Scenario 1 Implementation
In
the
intelligent
wired
edge
use
scenario,
the
five
NAC
functions
are
implemented
in
the
following
manner:
1.
Detection
‐
The
user
ʹ
s
end
‐
system
connects
to
the
network.
The
edge
switch
sends
a
RADIUS
authentication
request
(802.1X,
web
‐
based,
or
MAC
authentication)
with
the
associated
credentials
to
the
NAC
Gateway.
2.
Authentication
‐
If
the
end
‐
system
is
authenticating
to
the
network
using
802.1X
or
web
‐
based
authentication,
the
NAC
Gateway
proxies
the
RADIUS
authentication
request
to
a
backend
authentication
(RADIUS)
server
to
validate
the
identity
of
the
end
user/device.
For
end
‐
systems
that
are
MAC
authenticating
to
the
network,
the
NAC
Gateway
can
be
configured
to
either
proxy
the
MAC
authentication
requests
to
the
RADIUS
server
or
locally
authorize
MAC
authentication
requests.
If
only
MAC
authentication
is
deployed
on
the
network,
and
the
NAC
Gateway
is
configured
to
locally
authorize
MAC
authentication
requests,
a
backend
RADIUS
server
is
not
required
for
the
Enterasys
NAC
solution.
3.
Assessment
‐
After
the
identity
of
the
end
‐
system
or
end
user
is
validated
via
authentication,
the
NAC
Gateway
requests
an
assessment
of
the
end
‐
system
according
to
predefined
security
policy
parameters.
The
assessment
can
be
agent
‐
based
or
agent
‐
less,
and
is
executed
locally
by
the
NAC
Gateway
ʹ
s
assessment
functionality
and/or
remotely
by
a
pool
of
assessment
servers.
4.
Authorization
‐
Once
authentication
and
assessment
are
complete,
the
NAC
Gateway
allocates
the
appropriate
network
resources
to
the
end
‐
system
based
on
authentication
and/or
assessment
results.
For
Enterasys
policy
‐
enabled
edge
switches,
the
NAC
Gateway
formats
information
in
the
RADIUS
authentication
messages
that
directs
the
edge
switch
to
dynamically
assign
a
particular
policy
to
the
connecting
end
‐
system.
For
RFC
3580
‐
capable
edge
switches,
the
NAC
Gateway
formats
information
in
the
RADIUS
authentication
messages
(in
the
form
of
RFC
3580
VLAN
Tunnel
attributes)
that
directs
the
edge
switch
to
dynamically
assign
a
particular
VLAN
to
the
connecting
end
‐
system.
If
authentication
fails
and/or
the
assessment
results
indicate
a
noncompliant
end
‐
system,
the
NAC
Gateway
can
either
deny
the
end
‐
system
access
to
the
network
by
sending
a
RADIUS
access
reject
message
to
the
edge
switch,
or
quarantine
the
end
‐
system
by
assigning
a
Quarantine
policy
or
VLAN
to
the
end
‐
system
on
the
edge
switch.
5.
Remediation
‐
When
the
quarantined
end
user
opens
a
web
browser
to
any
web
site,
its
traffic
is
dynamically
redirected
to
a
Remediation
web
page
that
describes
the
compliance
violations
and
provides
remediations
steps
for
the
user
to
execute
in
order
to
achieve
compliance.
After
taking
the
appropriate
remediation
steps,
the
end
user
clicks
on
a
button
on
the
web
page
to
reattempt
network
access,
forcing
the
re
‐
assessment
of
the
end
‐
system.
At
this
point,
the
Enterasys
NAC
solution
transitions
the
end
‐
system
through
the
entire
NAC
cycle
of
detection,
authentication,
assessment,
and
authorization,
re
‐
assessing
the
security
posture
of
the
end
‐
system
to
determine
if
the
remediation
steps
were
successfully
followed.
If
the
end
‐
system
is
now
compliant
with
network
security
policy,
the
NAC
Gateway
authorizes
the
end
‐
system
with
the
appropriate
policy
or
VLAN.
If
the
end
‐
system
is
not
compliant,
the
end
‐
system
is
restricted
access
to
the
network
and
the
process
starts
again.
It
is
important
to
note
that
if
the
wired
edge
of
the
network
is
non
‐
intelligent
(unmanaged
switches
and
hubs)
and
is
not
capable
of
authenticating
and
authorizing
locally
connected
end
‐
systems,
it
is
possible
to
augment
the
network
topology
to
allow
implementation
of
out
‐
of
‐
band
NAC
with
the
NAC
Gateway.
This
can
be
accomplished
without
replacing
the
physical
edge
of
the
network,
by
adding
an
intelligent
edge
switch
that
possesses
specialized
authentication
and
authorization
features.
The
Enterasys
Matrix
N
‐
series
switch
is
capable
of
authenticating
and
authorizing
numerous
end
‐
systems
connected
on
a
single
port
through
its
Multi
‐
User
Authentication
(MUA)
functionality
and
may
be
positioned
upstream
from
non
‐
intelligent
third
‐
party
edge
devices
to
act
as
the
Содержание 9034385
Страница 1: ...Enterasys Network Access Control Design Guide P N 9034385...
Страница 2: ......
Страница 4: ...ii...
Страница 8: ...vi...
Страница 22: ...Summary 1 12 Overview...
Страница 98: ...Additional Considerations 5 34 Design Procedures...
