manualshive.com logo in svg

Enterasys 9034385, Руководство по конструкции, Страница: 61 / 98

Поделиться
Скачать
Enterasys 9034385 Скачать руководство пользователя страница 61

Survey the Network

Enterasys NAC Design Guide 4-9

If

 

the

 

network

 

infrastructure

 

does

 

not

 

contain

 

intelligent

 

devices

 

at

 

the

 

edge

 

or

 

distribution

 

layer,

 

then

 

inline

 

NAC

 

using

 

the

 

NAC

 

Controller

 

as

 

the

 

authorization

 

point

 

for

 

connecting

 

end

‐

systems

 

must

 

be

 

implemented.

 

This

 

is

 

not

 

as

 

secure

 

as

 

out

‐

of

‐

band

 

NAC

 

because

 

the

 

authorization

 

point

 

for

 

end

‐

systems

 

is

 

located

 

deeper

 

into

 

the

 

network

 

at

 

the

 

NAC

 

Controller.

 

With

 

inline

 

NAC,

 

a

 

quarantined

 

end

‐

system,

 

while

 

restricted

 

from

 

network

 

access

 

to

 

resources

 

upstream

 

from

 

the

 

NAC

 

Controller,

 

is

 

still

 

able

 

to

 

interact

 

openly

 

with

 

resources

 

and

 

assets

 

on

 

the

 

network

 

downstream

 

from

 

the

 

NAC

 

Controller.

 

However,

 

an

 

advantage

 

of

 

the

 

NAC

 

Controller

 

is

 

that

 

it

 

provides

 

network

 

access

 

control

 

without

 

requiring

 

the

 

upgrade

 

of

 

the

 

access

 

layer

 

or

 

distribution

 

layer

 

of

 

the

 

network.

 

Furthermore,

 

it

 

is

 

important

 

to

 

note

 

that

 

the

 

NAC

 

Controller

 

and

 

NAC

 

Gateway

 

can

 

be

 

deployed

 

concurrently

 

in

 

the

 

network

 

for

 

the

 

simultaneous

 

implementation

 

of

 

inline

 

and

 

out

‐

of

‐

band

 

NAC,

 

all

 

centrally

 

managed

 

from

 

the

 

NetSight

 

NAC

 

Manager.

 

The

 

NAC

 

Gateway

 

can

 

be

 

utilized

 

for

 

areas

 

of

 

the

 

network

 

where

 

intelligent

 

switches

 

reside,

 

while

 

the

 

NAC

 

Controller

 

can

 

be

 

positioned

 

inline

 

for

 

segments

 

of

 

the

 

network

 

where

 

non

‐

intelligent

 

devices

 

exist.

If

 

the

 

deployment

 

of

 

out

‐

of

‐

band

 

NAC

 

is

 

desired

 

for

 

a

 

network

 

with

 

non

‐

intelligent

 

access

 

layer

 

devices,

 

the

 

following

 

options

 

should

 

be

 

considered:

•

Distribution

 

layer

 

infrastructure

 

devices

 

can

 

be

 

strategically

 

upgraded

 

to

 

Enterasys

 

Matrix

 

N

‐

Series

 

devices

 

that

 

are

 

capable

 

of

 

individually

 

authenticating

 

and

 

uniquely

 

authorizing

 

multiple

 

devices

 

connected

 

to

 

a

 

single

 

port.

 

Most

 

of

 

the

 

security

 

benefits

 

of

 

out

‐

of

‐

band

 

NAC

 

using

 

Enterasys

 

policy

 

can

 

be

 

obtained

 

by

 

implementing

 

authorization

 

at

 

the

 

distribution

 

layer

 

instead

 

of

 

at

 

the

 

port

 

of

 

connection

 

in

 

the

 

access

 

layer.

 

•

Access

 

layer

 

infrastructure

 

devices

 

can

 

be

 

upgraded

 

to

 

Enterasys

 

policy

‐

capable

 

switches

 

or

 

RFC

 

3580

‐

capable

 

switches

 

to

 

obtain

 

the

 

security

 

benefits

 

of

 

out

‐

of

‐

band

 

NAC.

4. Identify Network Connection Methods

The

 

previous

 

steps

 

have

 

been

 

concerned

 

with

 

implementing

 

NAC

 

for

 

the

 

internal

 

LAN.

 

In

 

this

 

step,

 

various

 

types

 

of

 

network

 

connection

 

methods

 

are

 

discussed,

 

along

 

with

 

their

 

impact

 

on

 

NAC

 

deployment.

Wired LAN

Out

‐

of

‐

band

 

or

 

inline

 

NAC

 

can

 

be

 

implemented,

 

depending

 

on

 

the

 

capabilities

 

of

 

the

 

access

 

edge

 

infrastructure

 

devices.

Wireless LAN

Wireless

 

LAN

 

deployments

 

may

 

be

 

categorized

 

into

 

either

 

thick

 

wireless

 

deployments

 

where

 

access

 

points

 

(APs)

 

operate

 

independently

 

on

 

the

 

network,

 

or

 

thin

 

wireless

 

deployments

 

where

 

APs

 

communicate

 

back

 

to

 

centrally

 

deployed

 

wireless

 

switches

 

that

 

facilitate

 

communication

 

between

 

APs.

Thick Wireless Deployments

Thick

 

wireless

 

deployments

 

may

 

consist

 

of

 

full

‐

featured

 

APs

 

that

 

support

 

authentication

 

and

 

authorization.

 

Full

‐

featured

 

thick

 

APs

 

fall

 

into

 

the

 

intelligent

 

edge

 

category

 

and

 

have

 

the

 

same

 

NAC

 

implications

 

as

 

an

 

intelligent

 

wired

 

edge.

 

In

 

this

 

case,

 

intelligent

 

APs

 

in

 

a

 

thick

 

wireless

 

deployment

 

can

 

be

 

configured

 

with

 

out

‐

of

‐

band

 

NAC

 

using

 

the

 

NAC

 

Gateway,

 

with

 

authentication

 

and

 

authorization

 

implemented

 

on

 

the

 

thick

 

APs.

 

Other

 

thick

 

AP

 

deployments

 

may

 

consist

 

of

 

APs

 

that

 

do

 

not

 

support

 

authentication

 

and/or

 

authorization

 

and

 

merely

 

act

 

as

 

a

 

media

 

converter

 

between

 

the

 

wireless

 

and

 

wired

 

networks.

 

In

 

Содержание 9034385

Страница 1: ...Enterasys Network Access Control Design Guide P N 9034385...

Страница 2: ......

Страница 3: ...B SITE OR THE INFORMATION CONTAINED IN THEM EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF KNEW OF OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES Enterasys Networks Inc 50 Minuteman Road Ando...

Страница 4: ...ii...

Страница 5: ...t Models Model 1 End System Detection and Tracking 2 1 Implementation 2 1 Out of Band NAC 2 1 Inline NAC Layer 2 2 2 Inline NAC Layer 3 2 2 Features and Value 2 2 Required and Optional Components 2 3...

Страница 6: ...d LAN 4 9 Wireless LAN 4 9 Remote Access WAN 4 10 Site to Site VPN 4 10 Remote Access VPN 4 11 Identify Inline or Out of band NAC Deployment 4 11 Summary 4 11 Chapter 5 Design Procedures Procedures fo...

Страница 7: ...4 5 1 Security Domain 5 3 5 2 NAC Configuration 5 4 5 3 NAC Configuration for a Security Domain 5 6 5 4 MAC and User Override Configuration 5 13 5 5 NAC Gateway Redundancy 5 21 5 6 Policy Role Configu...

Страница 8: ...vi...

Страница 9: ...de provides product descriptions and installation instructions for the NAC Controller NAC Gateway Appliance Installation Guide for the installation of the Enterasys NAC Gateway SNS TAG HPA and SNS TAG...

Страница 10: ...g Enterasys Networks for technical support have the following data ready Your Enterasys Networks service contract number A description of the failure A description of any action s already taken to res...

Страница 11: ...etwork For end systems which are not compliant with defined security guidelines the NAC solution provides assisted remediation allowing end users to perform self service repair steps specific to the d...

Страница 12: ...a captive portal email notification pop up messages and messenger service integration among others The remediation process includes updating the device to meet corporate security requirements for exa...

Страница 13: ...esources based on the security posture of a connecting end system as well as user and device identity and location End systems that fail assessment can be dynamically quarantined with restrictive netw...

Страница 14: ...eir end systems have been quarantined due to network security policy non compliance and allows end users to safely remediate their end systems without assistance from IT operations Table 1 1 Component...

Страница 15: ...provides integrated assessment servers A separate license is required for integrated assessment This integrated NAC Gateway supports both agent less network based and agent based assessment In additio...

Страница 16: ...ontroller is positioned before the first routed boundary for connecting end systems closer to the access edge of the network the Layer 2 NAC Controller mode is utilized In this mode of operation the N...

Страница 17: ...e network Assessment Assessment can be implemented using localized integrated agent based and or agent less assessment1 or external agent based and or agent less assessment using a bank of external as...

Страница 18: ...omplex because the NAC Gateway requires that an authentication method is deployed on the network and that the authenticating access edge switches are capable of dynamically authorizing end systems bas...

Страница 19: ...larity Advantage The NAC Gateway is always aware of the MAC address of the device connecting to the network and its associated IP address username and location switch IP address and port Therefore NAC...

Страница 20: ...component of the NAC solution providing comprehensive network inventory and change management capabilities for your network infrastructure RADIUS Server A RADIUS server with backend directory service...

Страница 21: ...quarantined end system without impacting IT operations Enterasys offers two types of NAC appliances The NAC Gateway appliance implements out of band network access control and requires the implementat...

Страница 22: ...Summary 1 12 Overview...

Страница 23: ...users connected to the network in order to profile and enumerate the assets on the enterprise network It is important to note that in this model the NAC solution does not play a part in authorizing a...

Страница 24: ...atures and Value There are two key pieces of functionality and value propositions supported by Model 1 End System and User Tracking Model 1 supports the ability to track end systems by MAC address as...

Страница 25: ...being assessed for security posture compliance when connecting to the network A RADIUS server is only required if out of band network access control using the NAC Gateway or inline network access cont...

Страница 26: ...ources to the end system based on device identity user identity and location For Enterasys policy enabled edge switches the NAC Gateway formats information in the RADIUS authentication messages that d...

Страница 27: ...cific location such as behind a firewall or on a particular VLAN for security reasons Physically moving the connection of these devices to an open area of the network increases the risk of these devic...

Страница 28: ...is user connects to the network In contrast a user in the IT operations group or a technician sent to repair a device on the network may be permitted unrestricted access to network resources for troub...

Страница 29: ...from any location enterprise wide If ASM reverses the quarantine action it notifies NAC Manager and the quarantine is automatically removed and the end system is dynamically re admitted access to net...

Страница 30: ...to quarantine end systems that fail assessment In fact during the initial rollout of NAC on the enterprise network it is highly recommended that end systems are not restricted access to the network i...

Страница 31: ...system the NAC Gateway can either deny the end system access to the network by sending a RADIUS access reject message to the edge switch or quarantine the end system with a highly restrictive set of...

Страница 32: ...lnerabilities present in services running on unpatched laptops are appropriately remediated so that attacks that target those vulnerabilities are not successful if they reach the device on the network...

Страница 33: ...veral reasons why both assessment models are critical to a complete NAC solution Security agents loaded onto managed end systems offer extensive assessment capabilities If an agent is required a new e...

Страница 34: ...licy Manager provides the ability to centrally define and configure the authorization levels or policies NetSight Inventory Manager is an optional component providing comprehensive network inventory a...

Страница 35: ...ng way Detection As described in Model 2 Authentication As described in Model 2 Assessment As described in Model 3 Authorization As described in Model 3 Remediation When end systems are quarantined by...

Страница 36: ...access needed services With the Enterasys NAC solution network based notification and remediation are integrated Once an end system is put into a quarantine state notification is achieved by redirect...

Страница 37: ...ware application used to monitor the health and status of infrastructure devices in the network including switches routers and Enterasys NAC appliances NAC Gateways and NAC Controllers Assessment func...

Страница 38: ...End System Authorization In addition to the values from Model 1 Location based authorization using Security Domains and Lock MAC features Special handling of end systems or users with MAC User overrid...

Страница 39: ...ssignment as defined in RFC 3580 Scenario 1 Intelligent Wired Access Edge In the intelligent wired access edge use scenario the edge switches that compose the network access layer are capable of provi...

Страница 40: ...sys NAC components work together in a network with policy enabled edge switches to provide a comprehensive NAC solution Figure 3 1 Intelligent Wired Access Edge with Enterasys Policy Enabled Devices 1...

Страница 41: ...d party switches that support RFC 3580 Figure 3 2 Intelligent Wired Access Edge with RFC 3580 Capable Devices 1 4 3 2 3 5 5 Remediation Web Page 3 Enterasys NAC Manager 3rd Party Switch RFC 3850 compl...

Страница 42: ...0 VLAN Tunnel attributes that directs the edge switch to dynamically assign a particular VLAN to the connecting end system If authentication fails and or the assessment results indicate a noncompliant...

Страница 43: ...securely contained with policy at the Matrix N series port Scenario 2 Intelligent Wireless Access Edge In the intelligent wireless access edge use scenario thick Access Points APs or wireless switche...

Страница 44: ...less Access Point 5 3 Enterasys NAC Manager Intelligent Wireless Controller RFC 3850 compliant NAC Gateway out of band appliance Assessment Server Authentication Server optionally integrated in NAC Ga...

Страница 45: ...ng on the functionality supported by the APs The following figure illustrates how the NAC Gateway and the other Enterasys NAC components provide network access control in a thick wireless deployment F...

Страница 46: ...sults For Enterasys policy enabled wireless switches and access points the NAC Gateway formats information in the RADIUS authentication messages that directs the edge switch to dynamically assign a pa...

Страница 47: ...cated on the access edge By provisioning access to network resources on the Matrix N series via MUA end system traffic destined to adjacent switches on the network can be securely contained at the Mat...

Страница 48: ...inline appliance Assessment Server Authentication Server optionally integrated in NAC Controller Role Quarantine Layer 3 Wired LAN Role Quarantine Role Quarantine Layer 2 Wired LAN Layer 2 Wireless L...

Страница 49: ...ning a policy to traffic sourced from this end system If authentication fails and or the assessment results indicate a noncompliant end system the NAC Controller can either deny the end system access...

Страница 50: ...of the end system according to predefined security policy parameters The assessment can be agent based or agent less and is executed locally by the NAC Controller s assessment functionality and or rem...

Страница 51: ...summarizes four NAC use scenarios and their NAC appliance requirements The Enterasys NAC solution is capable of implementing network access control for all four use scenarios as well as environments w...

Страница 52: ...remote access VPN tunnels into the enterprise network Appliance Requirement NAC Controller Inline network access control is implemented by deploying the NAC Controller appliance to locally authorize c...

Страница 53: ...maintained over time for each device on the network yielding complete historical information about a device as it interacts with the network Model 2 End System Authorization Enterasys NAC detects auth...

Страница 54: ...and authorization of connecting end systems The NAC Gateway effects the assignment of policies or VLANs on Enterasys switches or RFC 3580 capable switches located at edge of the network to authorize...

Страница 55: ...d party are also part of the intelligent edge of the network because they are able to authenticate and authorize connecting end systems with a particular level of network access using dynamic VLAN ass...

Страница 56: ...entication Configuration For a network with an intelligent edge the second step in surveying your network is to evaluate the network authentication method currently being used and how the deployment o...

Страница 57: ...backend RADIUS server without requiring complex configuration changes to the RADIUS server and associated directory services In addition NAC can also be configured to locally authorize MAC authenticat...

Страница 58: ...bilities When authentication is configured on the network it is important to consider end system capabilities and their ability to interact with the authentication process Machine centric end systems...

Страница 59: ...entication and authorization of over 2000 users and devices per port providing the highest degree of authentication method configuration flexibility The SecureStack C2 C3 and B2 B3 User IP Phone authe...

Страница 60: ...f band NAC using the NAC Gateway appliance leverages policy on Enterasys switches to securely authorize connecting end systems RFC 3580 capable switches can be used for authentication and authorizatio...

Страница 61: ...ually authenticating and uniquely authorizing multiple devices connected to a single port Most of the security benefits of out of band NAC using Enterasys policy can be obtained by implementing author...

Страница 62: ...for remote users If the NAC Gateway is implemented at the main site then it is important to consider what impact a WAN link disconnection would have on the NAC process and remote end system connectivi...

Страница 63: ...ent requirements 1 Identify the intelligent edge in your network if it exists This information will be used to help you select which NAC appliance the NAC Gateway or NAC Controller best suits your net...

Страница 64: ...ms If the network infrastructure does not contain intelligent devices at the edge or distribution layer then inline NAC using the NAC Controller as the authorization point for connecting end systems m...

Страница 65: ...C Manager is a plugin application to NetSight Console it is necessary to have NetSight Console installed on a server with NAC Manager NetSight Console is used to monitor the health and status of devic...

Страница 66: ...or each area of the network that has its own unique requirements for end system authentication assessment and authorization A Security Domain defines a set of NAC Gateways and NAC Controllers that hav...

Страница 67: ...default NAC configuration that defines the authentication assessment and authorization parameters for all end systems connecting in that domain A Security Domain can also include MAC or user override...

Страница 68: ...on file that determines end system compliance with the SANS Top 20 vulnerabilities The same Nessus server can be used to assess Windows machines for Windows related vulnerabilities and also assess MAC...

Страница 69: ...he network a scoring override can be configured to associate a high risk score if Wireshark is detected on an end system Which end systems are quarantined NAC Manager uses risk levels to determine whe...

Страница 70: ...AC 5 6 Design Procedures The following figure shows the NAC Manager window used to create or edit a NAC Configuration and define its authentication assessment and authorization attributes Figure 5 3 N...

Страница 71: ...of RADIUS authentication requests to a RADIUS server If the RADIUS server returns a policy or VLAN based on user or end system identity uncheck Replace RADIUS Attributes with Accept Policy Otherwise...

Страница 72: ...rk These measures limit the network exposure to security threat propagation and protect against network instability In NAC Manager create a Security Domain with the following configuration attributes...

Страница 73: ...xy RADIUS Request to a RADIUS Server radio button selected check the Replace RADIUS Attributes with Accept Policy option and specify a non restrictive policy or VLAN in the Accept Policy field This al...

Страница 74: ...e mail servers web servers or PCs running a specific OS Microsoft 2003 Server Microsoft XP RedHat Linux MAC OS This requires that the Security Domain be associated to an Assessment Configuration that...

Страница 75: ...ng attribute The Use Assessment Policy While Assessing checkbox is not selected In this case NAC Manager assigns the policy or VLAN returned from the RADIUS server or the locally defined Accept Policy...

Страница 76: ...cular Security Domain A global override lets you specify how an end system is authenticated assessed and authorized whenever the end system connects to any Security Domain on the network Use the netwo...

Страница 77: ...3 The following figure displays the windows used for MAC and user override configuration in NAC Manager Notice that either an existing NAC Configuration can be used or a custom configuration can be sp...

Страница 78: ...all Security Domains for the MAC override scope For the assessment authentication and authorization configuration choose a NAC Configuration or specify a custom configuration with the following parame...

Страница 79: ...rize MAC Authentication Requests Locally so MAC authentication attempts by these devices are assigned the Accept Policy Check Replace RADIUS Policy with Accept Policy so the policy information returne...

Страница 80: ...access It is important to note that the Layer 3 NAC Controller may not determine the true MAC address of the downstream connected end system In this case a MAC override configured in NAC A device or...

Страница 81: ...ssessment servers added for load balancing and scalability purposes The same assessment server can be used for multiple Security Domains and each assessment server can assess end systems using differe...

Страница 82: ...uration An assessment server utilizes third party assessing software to execute scans against connecting end systems and this software must be locally configured with the security assessment parameter...

Страница 83: ...AC authentication The types of users connecting to the network It is necessary to understand how authentication affects the different type of users connecting to the network and what implications this...

Страница 84: ...TAG ITA appliances then the formula would be 9000 3000 3 required ITA appliances For each switch in a particular Security Domain the maximum number of authenticating end systems that may be connected...

Страница 85: ...ng the secondary NAC Gateway is the same model as the primary The secondary NAC Gateway is not configured as a primary NAC Gateway for any switch on the network and therefore is inactive until a prima...

Страница 86: ...y to the NAC Gateway over UDP IP and the NAC Gateway in turn communicates to a backend RADIUS server Therefore the only requirement for NAC Gateway placement is that a routable IP forwarding path exis...

Страница 87: ...on of user device network login credentials on the network If 802 1X web based or RADIUS authentication for switch management logins is implemented a RADIUS server with backend directory services must...

Страница 88: ...e NAC is deployed on the network each Enterasys switch in the intelligent edge of the network must be configured with the appropriate policy roles that may be returned from the NAC Gateways A list of...

Страница 89: ...locally by the NAC Gateway and when an end system has passed an assessment if an assessment was required or if the Accept Policy has been configured to replace the Filter ID information returned in t...

Страница 90: ...server will not detect the FTP vulnerabilities on the end system To achieve this trade off the Assessing policy role can be configured by default to deny all traffic and be associated to classificatio...

Страница 91: ...es are configured to allow access to the appropriate network resources for communication with the assessment servers during assessment This can be implemented by associating the Assessing service show...

Страница 92: ...re with steps specifically relating to the implementation of inline NAC with the NAC Controller 1 Determine NAC Controller Location Because the NAC Controller is placed inline with traffic sourced fro...

Страница 93: ...it should be understood that some advantages exist with the deployment of a Layer 2 NAC Controller over a Layer 3 NAC Controller which may affect the decision of how NAC Controllers are positioned Whi...

Страница 94: ...ed NAC Controllers of that type per Security Domain The configuration of NAC Controller redundancy To achieve redundancy at each location in the network where the NAC Controller is positioned an addit...

Страница 95: ...are positioned on either side of the NAC Controllers Redundant Layer 3 NAC Controllers are active active in that traffic from a downstream router may pass through either of the redundant Layer 3 NAC...

Страница 96: ...n be selected as the Failsafe Policy in the NAC Configuration The Enterprise User policy role is fairly open permitting most types of communication onto the network For security purposes the Enterpris...

Страница 97: ...rking environments with IDS technologies that detect real time security events on the network While end system assessment determines the security posture of connecting devices and mitigates threats po...

Страница 98: ...Additional Considerations 5 34 Design Procedures...

Отзывы:

Нет отзывов