manualshive.com logo in svg

Enterasys 9034385, Руководство по конструкции, Страница: 58 / 98

Поделиться
Скачать
Enterasys 9034385 Скачать руководство пользователя страница 58

Survey the Network

4-6 Design Planning

Similar

 

to

 

802.1X,

 

web

‐

based

 

authentication

 

requires

 

the

 

input

 

of

 

credentials

 

and

 

is

 

normally

 

used

 

on

 

user

‐

centric

 

end

‐

systems

 

that

 

have

 

a

 

concept

 

of

 

an

 

associated

 

user,

 

such

 

as

 

a

 

PC.

 

Therefore,

 

this

 

authentication

 

method

 

is

 

inappropriate

 

for

 

machine

‐

centric

 

devices

 

such

 

as

 

printers

 

and

 

IP

 

cameras.

Note

 

that

 

web

‐

based

 

authentication

 

is

 

a

 

user

‐

initiated

 

authentication

 

method

 

where

 

the

 

user

 

must

 

manually

 

begin

 

the

 

network

 

login

 

process

 

by

 

opening

 

a

 

web

 

browser

 

and

 

entering

 

credentials.

 

This

 

user

‐

initiated

 

method

 

prevents

 

seamless

 

network

 

connectivity

 

because

 

the

 

end

 

user

 

must

 

initiate

 

the

 

reauthentication

 

after

 

assessment

 

is

 

complete.

Since

 

Enterasys

 

NAC

 

only

 

acts

 

as

 

a

 

pass

‐

through

 

to

 

an

 

upstream

 

RADIUS

 

Server,

 

it

 

is

 

mandatory

 

that

 

a

 

full

 

authentication

 

deployment

 

is

 

configured

 

on

 

the

 

network

 

if

 

web

‐

based

 

authentication

 

is

 

used.

MAC

 

Authentication

MAC

 

authentication

 

authenticates

 

the

 

source

 

MAC

 

address

 

of

 

an

 

end

‐

system

 

and

 

grants

 

the

 

appropriate

 

level

 

of

 

access

 

by

 

validating

 

the

 

MAC

 

address

 

on

 

the

 

RADIUS

 

authentication

 

server.

 

This

 

authentication

 

method

 

only

 

requires

 

that

 

the

 

end

‐

system

 

generate

 

a

 

packet;

 

it

 

requires

 

no

 

special

 

software

 

on

 

the

 

end

‐

system.

Unlike

 

802.1X

 

and

 

web

‐

based

 

authentication,

 

MAC

 

authentication

 

can

 

be

 

used

 

to

 

authenticate

 

machine

‐

centric

 

end

‐

systems

 

that

 

have

 

no

 

concept

 

of

 

an

 

associated

 

user,

 

such

 

as

 

a

 

printer

 

or

 

IP

 

camera.

With

 

this

 

authentication

 

method,

 

Enterasys

 

NAC

 

can

 

act

 

as

 

a

 

pass

‐

through

 

to

 

an

 

upstream

 

RADIUS

 

Server

 

or

 

can

 

locally

 

authorize

 

MAC

 

authentication

 

attempts.

 

Therefore,

 

if

 

a

 

full

 

authentication

 

deployment

 

has

 

not

 

been

 

configured

 

on

 

the

 

network,

 

MAC

 

authentication

 

should

 

be

 

used.

End-System Capabilities

When

 

authentication

 

is

 

configured

 

on

 

the

 

network,

 

it

 

is

 

important

 

to

 

consider

 

end

‐

system

 

capabilities

 

and

 

their

 

ability

 

to

 

interact

 

with

 

the

 

authentication

 

process.

 

Machine

‐

centric

 

end

‐

systems

 

that

 

do

 

not

 

possess

 

an

 

802.1X

 

supplicant,

 

such

 

as

 

IP

 

cameras

 

and

 

printers,

 

may

 

only

 

be

 

capable

 

of

 

MAC

 

authenticating

 

to

 

the

 

network.

 

Some

 

human

‐

centric

 

end

‐

systems

 

such

 

as

 

PCs,

 

may

 

be

 

capable

 

of

 

802.1X

 

and

 

web

‐

based

 

authentication

 

while

 

other

 

PCs

 

not

 

installed

 

with

 

an

 

802.1X

 

supplicant,

 

are

 

only

 

capable

 

of

 

web

‐

based

 

authentication.

 

If

 

end

‐

systems

 

are

 

implementing

 

802.1X

 

and

 

web

‐

based

 

authentication,

 

Enterasys

 

NAC

 

should

 

leverage

 

these

 

authentication

 

methods

 

for

 

end

‐

system

 

detection.

 

For

 

end

‐

systems

 

not

 

implementing

 

802.1X

 

or

 

web

‐

based

 

authentication,

 

MAC

‐

based

 

authentication

 

can

 

be

 

enabled

 

on

 

these

 

switch

 

ports.

Support of Multiple Authentication Methods

In

 

order

 

to

 

support

 

an

 

enterprise

 

network

 

consisting

 

of

 

a

 

diverse

 

environment

 

of

 

machine

‐

centric

 

and

 

human

‐

centric

 

devices,

 

it

 

is

 

important

 

that

 

the

 

intelligent

 

edge

 

of

 

the

 

network

 

supports

 

the

 

concurrent

 

enabling

 

of

 

multiple

 

authentication

 

methods,

 

all

 

at

 

the

 

same

 

time

 

on

 

the

 

same

 

switch

 

port.

 

Some

 

intelligent

 

switches

 

may

 

not

 

support

 

the

 

enabling

 

of

 

multiple

 

authentication

 

methods

 

concurrently

 

on

 

a

 

single

 

port.

 

For

 

example,

 

MAC

 

and

 

802.1X

 

authentication

 

may

 

be

 

concurrently

 

enabled

 

on

 

a

 

port

 

to

 

account

 

for

 

the

 

fact

 

that

 

a

 

trusted

 

user,

 

guest

 

user,

 

or

 

IP

 

phone

 

may

 

connect

 

to

 

this

 

port.

 

The

 

ability

 

to

 

support

 

multiple

 

authentication

 

methods

 

concurrently

 

on

 

a

 

port

 

is

 

even

 

more

 

important

 

for

 

environments

 

where

 

mobility

 

of

 

devices

 

around

 

the

 

network

 

is

 

essential

 

for

 

ensuring

 

business

 

continuity.

 

Support for Multiple End-System Connection

It

 

is

 

important

 

to

 

know

 

whether

 

multiple

 

end

‐

system

 

connection

 

is

 

supported

 

by

 

the

 

intelligent

 

edge

 

of

 

the

 

network.

 

If

 

the

 

intelligent

 

edge

 

devices

 

only

 

support

 

the

 

authentication

 

of

 

one

 

end

‐

Содержание 9034385

Страница 1: ...Enterasys Network Access Control Design Guide P N 9034385...

Страница 2: ......

Страница 3: ...B SITE OR THE INFORMATION CONTAINED IN THEM EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF KNEW OF OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES Enterasys Networks Inc 50 Minuteman Road Ando...

Страница 4: ...ii...

Страница 5: ...t Models Model 1 End System Detection and Tracking 2 1 Implementation 2 1 Out of Band NAC 2 1 Inline NAC Layer 2 2 2 Inline NAC Layer 3 2 2 Features and Value 2 2 Required and Optional Components 2 3...

Страница 6: ...d LAN 4 9 Wireless LAN 4 9 Remote Access WAN 4 10 Site to Site VPN 4 10 Remote Access VPN 4 11 Identify Inline or Out of band NAC Deployment 4 11 Summary 4 11 Chapter 5 Design Procedures Procedures fo...

Страница 7: ...4 5 1 Security Domain 5 3 5 2 NAC Configuration 5 4 5 3 NAC Configuration for a Security Domain 5 6 5 4 MAC and User Override Configuration 5 13 5 5 NAC Gateway Redundancy 5 21 5 6 Policy Role Configu...

Страница 8: ...vi...

Страница 9: ...de provides product descriptions and installation instructions for the NAC Controller NAC Gateway Appliance Installation Guide for the installation of the Enterasys NAC Gateway SNS TAG HPA and SNS TAG...

Страница 10: ...g Enterasys Networks for technical support have the following data ready Your Enterasys Networks service contract number A description of the failure A description of any action s already taken to res...

Страница 11: ...etwork For end systems which are not compliant with defined security guidelines the NAC solution provides assisted remediation allowing end users to perform self service repair steps specific to the d...

Страница 12: ...a captive portal email notification pop up messages and messenger service integration among others The remediation process includes updating the device to meet corporate security requirements for exa...

Страница 13: ...esources based on the security posture of a connecting end system as well as user and device identity and location End systems that fail assessment can be dynamically quarantined with restrictive netw...

Страница 14: ...eir end systems have been quarantined due to network security policy non compliance and allows end users to safely remediate their end systems without assistance from IT operations Table 1 1 Component...

Страница 15: ...provides integrated assessment servers A separate license is required for integrated assessment This integrated NAC Gateway supports both agent less network based and agent based assessment In additio...

Страница 16: ...ontroller is positioned before the first routed boundary for connecting end systems closer to the access edge of the network the Layer 2 NAC Controller mode is utilized In this mode of operation the N...

Страница 17: ...e network Assessment Assessment can be implemented using localized integrated agent based and or agent less assessment1 or external agent based and or agent less assessment using a bank of external as...

Страница 18: ...omplex because the NAC Gateway requires that an authentication method is deployed on the network and that the authenticating access edge switches are capable of dynamically authorizing end systems bas...

Страница 19: ...larity Advantage The NAC Gateway is always aware of the MAC address of the device connecting to the network and its associated IP address username and location switch IP address and port Therefore NAC...

Страница 20: ...component of the NAC solution providing comprehensive network inventory and change management capabilities for your network infrastructure RADIUS Server A RADIUS server with backend directory service...

Страница 21: ...quarantined end system without impacting IT operations Enterasys offers two types of NAC appliances The NAC Gateway appliance implements out of band network access control and requires the implementat...

Страница 22: ...Summary 1 12 Overview...

Страница 23: ...users connected to the network in order to profile and enumerate the assets on the enterprise network It is important to note that in this model the NAC solution does not play a part in authorizing a...

Страница 24: ...atures and Value There are two key pieces of functionality and value propositions supported by Model 1 End System and User Tracking Model 1 supports the ability to track end systems by MAC address as...

Страница 25: ...being assessed for security posture compliance when connecting to the network A RADIUS server is only required if out of band network access control using the NAC Gateway or inline network access cont...

Страница 26: ...ources to the end system based on device identity user identity and location For Enterasys policy enabled edge switches the NAC Gateway formats information in the RADIUS authentication messages that d...

Страница 27: ...cific location such as behind a firewall or on a particular VLAN for security reasons Physically moving the connection of these devices to an open area of the network increases the risk of these devic...

Страница 28: ...is user connects to the network In contrast a user in the IT operations group or a technician sent to repair a device on the network may be permitted unrestricted access to network resources for troub...

Страница 29: ...from any location enterprise wide If ASM reverses the quarantine action it notifies NAC Manager and the quarantine is automatically removed and the end system is dynamically re admitted access to net...

Страница 30: ...to quarantine end systems that fail assessment In fact during the initial rollout of NAC on the enterprise network it is highly recommended that end systems are not restricted access to the network i...

Страница 31: ...system the NAC Gateway can either deny the end system access to the network by sending a RADIUS access reject message to the edge switch or quarantine the end system with a highly restrictive set of...

Страница 32: ...lnerabilities present in services running on unpatched laptops are appropriately remediated so that attacks that target those vulnerabilities are not successful if they reach the device on the network...

Страница 33: ...veral reasons why both assessment models are critical to a complete NAC solution Security agents loaded onto managed end systems offer extensive assessment capabilities If an agent is required a new e...

Страница 34: ...licy Manager provides the ability to centrally define and configure the authorization levels or policies NetSight Inventory Manager is an optional component providing comprehensive network inventory a...

Страница 35: ...ng way Detection As described in Model 2 Authentication As described in Model 2 Assessment As described in Model 3 Authorization As described in Model 3 Remediation When end systems are quarantined by...

Страница 36: ...access needed services With the Enterasys NAC solution network based notification and remediation are integrated Once an end system is put into a quarantine state notification is achieved by redirect...

Страница 37: ...ware application used to monitor the health and status of infrastructure devices in the network including switches routers and Enterasys NAC appliances NAC Gateways and NAC Controllers Assessment func...

Страница 38: ...End System Authorization In addition to the values from Model 1 Location based authorization using Security Domains and Lock MAC features Special handling of end systems or users with MAC User overrid...

Страница 39: ...ssignment as defined in RFC 3580 Scenario 1 Intelligent Wired Access Edge In the intelligent wired access edge use scenario the edge switches that compose the network access layer are capable of provi...

Страница 40: ...sys NAC components work together in a network with policy enabled edge switches to provide a comprehensive NAC solution Figure 3 1 Intelligent Wired Access Edge with Enterasys Policy Enabled Devices 1...

Страница 41: ...d party switches that support RFC 3580 Figure 3 2 Intelligent Wired Access Edge with RFC 3580 Capable Devices 1 4 3 2 3 5 5 Remediation Web Page 3 Enterasys NAC Manager 3rd Party Switch RFC 3850 compl...

Страница 42: ...0 VLAN Tunnel attributes that directs the edge switch to dynamically assign a particular VLAN to the connecting end system If authentication fails and or the assessment results indicate a noncompliant...

Страница 43: ...securely contained with policy at the Matrix N series port Scenario 2 Intelligent Wireless Access Edge In the intelligent wireless access edge use scenario thick Access Points APs or wireless switche...

Страница 44: ...less Access Point 5 3 Enterasys NAC Manager Intelligent Wireless Controller RFC 3850 compliant NAC Gateway out of band appliance Assessment Server Authentication Server optionally integrated in NAC Ga...

Страница 45: ...ng on the functionality supported by the APs The following figure illustrates how the NAC Gateway and the other Enterasys NAC components provide network access control in a thick wireless deployment F...

Страница 46: ...sults For Enterasys policy enabled wireless switches and access points the NAC Gateway formats information in the RADIUS authentication messages that directs the edge switch to dynamically assign a pa...

Страница 47: ...cated on the access edge By provisioning access to network resources on the Matrix N series via MUA end system traffic destined to adjacent switches on the network can be securely contained at the Mat...

Страница 48: ...inline appliance Assessment Server Authentication Server optionally integrated in NAC Controller Role Quarantine Layer 3 Wired LAN Role Quarantine Role Quarantine Layer 2 Wired LAN Layer 2 Wireless L...

Страница 49: ...ning a policy to traffic sourced from this end system If authentication fails and or the assessment results indicate a noncompliant end system the NAC Controller can either deny the end system access...

Страница 50: ...of the end system according to predefined security policy parameters The assessment can be agent based or agent less and is executed locally by the NAC Controller s assessment functionality and or rem...

Страница 51: ...summarizes four NAC use scenarios and their NAC appliance requirements The Enterasys NAC solution is capable of implementing network access control for all four use scenarios as well as environments w...

Страница 52: ...remote access VPN tunnels into the enterprise network Appliance Requirement NAC Controller Inline network access control is implemented by deploying the NAC Controller appliance to locally authorize c...

Страница 53: ...maintained over time for each device on the network yielding complete historical information about a device as it interacts with the network Model 2 End System Authorization Enterasys NAC detects auth...

Страница 54: ...and authorization of connecting end systems The NAC Gateway effects the assignment of policies or VLANs on Enterasys switches or RFC 3580 capable switches located at edge of the network to authorize...

Страница 55: ...d party are also part of the intelligent edge of the network because they are able to authenticate and authorize connecting end systems with a particular level of network access using dynamic VLAN ass...

Страница 56: ...entication Configuration For a network with an intelligent edge the second step in surveying your network is to evaluate the network authentication method currently being used and how the deployment o...

Страница 57: ...backend RADIUS server without requiring complex configuration changes to the RADIUS server and associated directory services In addition NAC can also be configured to locally authorize MAC authenticat...

Страница 58: ...bilities When authentication is configured on the network it is important to consider end system capabilities and their ability to interact with the authentication process Machine centric end systems...

Страница 59: ...entication and authorization of over 2000 users and devices per port providing the highest degree of authentication method configuration flexibility The SecureStack C2 C3 and B2 B3 User IP Phone authe...

Страница 60: ...f band NAC using the NAC Gateway appliance leverages policy on Enterasys switches to securely authorize connecting end systems RFC 3580 capable switches can be used for authentication and authorizatio...

Страница 61: ...ually authenticating and uniquely authorizing multiple devices connected to a single port Most of the security benefits of out of band NAC using Enterasys policy can be obtained by implementing author...

Страница 62: ...for remote users If the NAC Gateway is implemented at the main site then it is important to consider what impact a WAN link disconnection would have on the NAC process and remote end system connectivi...

Страница 63: ...ent requirements 1 Identify the intelligent edge in your network if it exists This information will be used to help you select which NAC appliance the NAC Gateway or NAC Controller best suits your net...

Страница 64: ...ms If the network infrastructure does not contain intelligent devices at the edge or distribution layer then inline NAC using the NAC Controller as the authorization point for connecting end systems m...

Страница 65: ...C Manager is a plugin application to NetSight Console it is necessary to have NetSight Console installed on a server with NAC Manager NetSight Console is used to monitor the health and status of devic...

Страница 66: ...or each area of the network that has its own unique requirements for end system authentication assessment and authorization A Security Domain defines a set of NAC Gateways and NAC Controllers that hav...

Страница 67: ...default NAC configuration that defines the authentication assessment and authorization parameters for all end systems connecting in that domain A Security Domain can also include MAC or user override...

Страница 68: ...on file that determines end system compliance with the SANS Top 20 vulnerabilities The same Nessus server can be used to assess Windows machines for Windows related vulnerabilities and also assess MAC...

Страница 69: ...he network a scoring override can be configured to associate a high risk score if Wireshark is detected on an end system Which end systems are quarantined NAC Manager uses risk levels to determine whe...

Страница 70: ...AC 5 6 Design Procedures The following figure shows the NAC Manager window used to create or edit a NAC Configuration and define its authentication assessment and authorization attributes Figure 5 3 N...

Страница 71: ...of RADIUS authentication requests to a RADIUS server If the RADIUS server returns a policy or VLAN based on user or end system identity uncheck Replace RADIUS Attributes with Accept Policy Otherwise...

Страница 72: ...rk These measures limit the network exposure to security threat propagation and protect against network instability In NAC Manager create a Security Domain with the following configuration attributes...

Страница 73: ...xy RADIUS Request to a RADIUS Server radio button selected check the Replace RADIUS Attributes with Accept Policy option and specify a non restrictive policy or VLAN in the Accept Policy field This al...

Страница 74: ...e mail servers web servers or PCs running a specific OS Microsoft 2003 Server Microsoft XP RedHat Linux MAC OS This requires that the Security Domain be associated to an Assessment Configuration that...

Страница 75: ...ng attribute The Use Assessment Policy While Assessing checkbox is not selected In this case NAC Manager assigns the policy or VLAN returned from the RADIUS server or the locally defined Accept Policy...

Страница 76: ...cular Security Domain A global override lets you specify how an end system is authenticated assessed and authorized whenever the end system connects to any Security Domain on the network Use the netwo...

Страница 77: ...3 The following figure displays the windows used for MAC and user override configuration in NAC Manager Notice that either an existing NAC Configuration can be used or a custom configuration can be sp...

Страница 78: ...all Security Domains for the MAC override scope For the assessment authentication and authorization configuration choose a NAC Configuration or specify a custom configuration with the following parame...

Страница 79: ...rize MAC Authentication Requests Locally so MAC authentication attempts by these devices are assigned the Accept Policy Check Replace RADIUS Policy with Accept Policy so the policy information returne...

Страница 80: ...access It is important to note that the Layer 3 NAC Controller may not determine the true MAC address of the downstream connected end system In this case a MAC override configured in NAC A device or...

Страница 81: ...ssessment servers added for load balancing and scalability purposes The same assessment server can be used for multiple Security Domains and each assessment server can assess end systems using differe...

Страница 82: ...uration An assessment server utilizes third party assessing software to execute scans against connecting end systems and this software must be locally configured with the security assessment parameter...

Страница 83: ...AC authentication The types of users connecting to the network It is necessary to understand how authentication affects the different type of users connecting to the network and what implications this...

Страница 84: ...TAG ITA appliances then the formula would be 9000 3000 3 required ITA appliances For each switch in a particular Security Domain the maximum number of authenticating end systems that may be connected...

Страница 85: ...ng the secondary NAC Gateway is the same model as the primary The secondary NAC Gateway is not configured as a primary NAC Gateway for any switch on the network and therefore is inactive until a prima...

Страница 86: ...y to the NAC Gateway over UDP IP and the NAC Gateway in turn communicates to a backend RADIUS server Therefore the only requirement for NAC Gateway placement is that a routable IP forwarding path exis...

Страница 87: ...on of user device network login credentials on the network If 802 1X web based or RADIUS authentication for switch management logins is implemented a RADIUS server with backend directory services must...

Страница 88: ...e NAC is deployed on the network each Enterasys switch in the intelligent edge of the network must be configured with the appropriate policy roles that may be returned from the NAC Gateways A list of...

Страница 89: ...locally by the NAC Gateway and when an end system has passed an assessment if an assessment was required or if the Accept Policy has been configured to replace the Filter ID information returned in t...

Страница 90: ...server will not detect the FTP vulnerabilities on the end system To achieve this trade off the Assessing policy role can be configured by default to deny all traffic and be associated to classificatio...

Страница 91: ...es are configured to allow access to the appropriate network resources for communication with the assessment servers during assessment This can be implemented by associating the Assessing service show...

Страница 92: ...re with steps specifically relating to the implementation of inline NAC with the NAC Controller 1 Determine NAC Controller Location Because the NAC Controller is placed inline with traffic sourced fro...

Страница 93: ...it should be understood that some advantages exist with the deployment of a Layer 2 NAC Controller over a Layer 3 NAC Controller which may affect the decision of how NAC Controllers are positioned Whi...

Страница 94: ...ed NAC Controllers of that type per Security Domain The configuration of NAC Controller redundancy To achieve redundancy at each location in the network where the NAC Controller is positioned an addit...

Страница 95: ...are positioned on either side of the NAC Controllers Redundant Layer 3 NAC Controllers are active active in that traffic from a downstream router may pass through either of the redundant Layer 3 NAC...

Страница 96: ...n be selected as the Failsafe Policy in the NAC Configuration The Enterprise User policy role is fairly open permitting most types of communication onto the network For security purposes the Enterpris...

Страница 97: ...rking environments with IDS technologies that detect real time security events on the network While end system assessment determines the security posture of connecting devices and mitigates threats po...

Страница 98: ...Additional Considerations 5 34 Design Procedures...

Отзывы:

Нет отзывов