Scenario 3: Non-intelligent Access Edge (Wired and Wireless)
Enterasys NAC Design Guide 3-9
It
is
important
to
note
that
if
the
wireless
edge
of
the
network
is
non
‐
intelligent
and
not
capable
of
authenticating
and
authorizing
wireless
end
‐
systems,
it
is
possible
to
augment
the
network
topology
to
implement
out
‐
of
‐
band
NAC
with
the
NAC
Gateway.
This
can
be
accomplished
without
replacing
the
physical
edge
of
the
network,
by
adding
an
intelligent
edge
switch
that
possesses
specialized
authentication
and
authorization
features.
The
Enterasys
Matrix
N
‐
series
switch
is
capable
of
authenticating
and
authorizing
numerous
end
‐
systems
connected
on
a
single
port
through
Multi
‐
User
Authentication
(MUA),
and
may
be
positioned
upstream
from
non
‐
intelligent
third
‐
party
wireless
APs
to
act
as
the
intelligent
edge
on
the
network.
The
Enterasys
Matrix
N
‐
series
switch
is
capable
of
authenticating
and
authorizing
over
1000
end
‐
systems
uplinked
to
a
single
Matrix
N
‐
series
port
from
an
AP,
a
set
of
APs,
or
wireless
switches.
In
this
configuration,
the
Matrix
N
‐
series
acts
as
the
intelligent
edge
switch
on
the
network,
although
not
physically
located
on
the
access
edge.
By
provisioning
access
to
network
resources
on
the
Matrix
N
‐
series
via
MUA,
end
‐
system
traffic
destined
to
adjacent
switches
on
the
network
can
be
securely
contained
at
the
Matrix
N
‐
series
port.
Scenario 3: Non-intelligent Access Edge (Wired and Wireless)
In
the
non
‐
intelligent
access
edge
use
scenario,
the
edge
switches
and
access
points
that
compose
the
network
access
layer
are
not
capable
of
authenticating
and
authorizing
the
connecting
end
‐
systems
on
the
network.
In
this
scenario,
inline
NAC
is
implemented
by
positioning
the
NAC
Controller
at
a
strategic
point
in
the
network
topology,
as
the
authorization
point
for
end
‐
system
traffic
enforcement.
The
NAC
Controller
may
be
positioned
directly
within
the
VLAN
where
end
‐
systems
are
connected
or
across
one
or
more
routed
boundaries.
When
the
NAC
Controller
is
positioned
within
the
VLAN
where
end
‐
systems
are
connected,
each
device
is
uniquely
identified
by
its
associated
MAC
address.
When
the
NAC
Controller
is
positioned
across
a
routed
boundary
(for
example,
behind
a
WAN
router
located
in
an
enterprise
ʹ
s
central
site),
each
end
‐
system
is
identified
by
its
associated
IP
address.
The
following
figure
illustrates
how
the
NAC
Controller
and
the
other
Enterasys
NAC
components
work
together
in
the
non
‐
intelligent
edge
to
provide
network
access
control.
Содержание 9034385
Страница 1: ...Enterasys Network Access Control Design Guide P N 9034385...
Страница 2: ......
Страница 4: ...ii...
Страница 8: ...vi...
Страница 22: ...Summary 1 12 Overview...
Страница 98: ...Additional Considerations 5 34 Design Procedures...