manualshive.com logo in svg

Enterasys 9034385, Руководство по конструкции, Страница: 65 / 98

Поделиться
Скачать
Enterasys 9034385 Скачать руководство пользователя страница 65

Enterasys NAC Design Guide 5-1

5

Design Procedures

This

 

chapter

 

describes

 

the

 

design

 

procedures

 

for

 

Enterasys

 

NAC

 

deployment

 

on

 

an

 

enterprise

 

network.

 

The

 

first

 

section

 

discusses

 

procedures

 

for

 

both

 

out

‐

of

‐

band

 

and

 

inline

 

NAC

 

deployments.

 

The

 

second

 

section

 

discusses

 

procedures

 

for

 

deployments

 

implementing

 

assessment.

 

Subsequent

 

sections

 

present

 

design

 

steps

 

relating

 

specifically

 

to

 

out

‐

of

 

band

 

deployments

 

using

 

the

 

NAC

 

Gateway

 

and

 

inline

 

deployments

 

using

 

the

 

NAC

 

Controller.

Procedures for Out-of-Band and Inline NAC

This

 

section

 

presents

 

design

 

procedures

 

that

 

are

 

applicable

 

to

 

both

 

out

‐

of

‐

band

 

and

 

inline

 

NAC

 

deployments.

1. Identify Required NetSight Applications

As

 

discussed

 

in

 

“

NetSight

 

Management

”

 

on

 

page 1

‐

9,

 

the

 

Enterasys

 

NAC

 

solution

 

requires

 

the

 

installation

 

of

 

two

 

applications

 

from

 

the

 

NetSight

 

management

 

software

 

suite.

 

NetSight

 

NAC

 

Manager

 

is

 

required

 

to

 

centrally

 

manage

 

the

 

NAC

 

Controller

 

and

 

NAC

 

Gateway

 

appliances

 

on

 

the

 

network.

 

Because

 

NAC

 

Manager

 

is

 

a

 

plugin

 

application

 

to

 

NetSight

 

Console,

 

it

 

is

 

necessary

 

to

 

have

 

NetSight

 

Console

 

installed

 

on

 

a

 

server

 

with

 

NAC

 

Manager.

 

NetSight

 

Console

 

is

 

used

 

to

 

monitor

 

the

 

health

 

and

 

status

 

of

 

devices

 

on

 

the

 

network,

 

including

 

the

 

access

 

layer

 

switches

 

and

 

the

 

NAC

 

appliances.

In

 

addition,

 

NetSight

 

Policy

 

Manager

 

is

 

required

 

for

 

inline

 

NAC

 

deployments.

 

Policy

 

Manager

 

is

 

used

 

to

 

centrally

 

define

 

and

 

distribute

 

policies

 

to

 

all

 

NAC

 

Controllers

 

on

 

the

 

network.

For

 

out

‐

of

‐

band

 

NAC

 

deployments

 

that

 

include

 

Enterasys

 

policy

‐

enabled

 

switches

 

in

 

the

 

intelligent

 

edge,

 

policies

 

are

 

specified

 

in

 

NAC

 

Manager

 

that

 

authorize

 

connecting

 

end

‐

systems

 

with

 

a

 

particular

 

level

 

of

 

network

 

access.

 

Policies

 

are

 

centrally

 

defined

 

and

 

distributed

 

to

 

those

 

Enterasys

 

switches

 

using

 

Policy

 

Manager.

 

With

 

Policy

 

Manager,

 

policy

 

roles

 

are

 

easily

 

defined

 

and

 

enforced

 

to

 

all

 

Enterasys

 

switches

 

in

 

the

 

entire

 

intelligent

 

edge

 

of

 

the

 

network,

 

from

 

one

 

central

 

location.

For information about...

Refer to page...

Procedures for Out-of-Band and Inline NAC

5-1

Assessment Design Procedures

5-17

Out-of-Band NAC Design Procedures

5-19

Inline NAC Design Procedures

5-28

Additional Considerations

5-33

Содержание 9034385

Страница 1: ...Enterasys Network Access Control Design Guide P N 9034385...

Страница 2: ......

Страница 3: ...B SITE OR THE INFORMATION CONTAINED IN THEM EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF KNEW OF OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES Enterasys Networks Inc 50 Minuteman Road Ando...

Страница 4: ...ii...

Страница 5: ...t Models Model 1 End System Detection and Tracking 2 1 Implementation 2 1 Out of Band NAC 2 1 Inline NAC Layer 2 2 2 Inline NAC Layer 3 2 2 Features and Value 2 2 Required and Optional Components 2 3...

Страница 6: ...d LAN 4 9 Wireless LAN 4 9 Remote Access WAN 4 10 Site to Site VPN 4 10 Remote Access VPN 4 11 Identify Inline or Out of band NAC Deployment 4 11 Summary 4 11 Chapter 5 Design Procedures Procedures fo...

Страница 7: ...4 5 1 Security Domain 5 3 5 2 NAC Configuration 5 4 5 3 NAC Configuration for a Security Domain 5 6 5 4 MAC and User Override Configuration 5 13 5 5 NAC Gateway Redundancy 5 21 5 6 Policy Role Configu...

Страница 8: ...vi...

Страница 9: ...de provides product descriptions and installation instructions for the NAC Controller NAC Gateway Appliance Installation Guide for the installation of the Enterasys NAC Gateway SNS TAG HPA and SNS TAG...

Страница 10: ...g Enterasys Networks for technical support have the following data ready Your Enterasys Networks service contract number A description of the failure A description of any action s already taken to res...

Страница 11: ...etwork For end systems which are not compliant with defined security guidelines the NAC solution provides assisted remediation allowing end users to perform self service repair steps specific to the d...

Страница 12: ...a captive portal email notification pop up messages and messenger service integration among others The remediation process includes updating the device to meet corporate security requirements for exa...

Страница 13: ...esources based on the security posture of a connecting end system as well as user and device identity and location End systems that fail assessment can be dynamically quarantined with restrictive netw...

Страница 14: ...eir end systems have been quarantined due to network security policy non compliance and allows end users to safely remediate their end systems without assistance from IT operations Table 1 1 Component...

Страница 15: ...provides integrated assessment servers A separate license is required for integrated assessment This integrated NAC Gateway supports both agent less network based and agent based assessment In additio...

Страница 16: ...ontroller is positioned before the first routed boundary for connecting end systems closer to the access edge of the network the Layer 2 NAC Controller mode is utilized In this mode of operation the N...

Страница 17: ...e network Assessment Assessment can be implemented using localized integrated agent based and or agent less assessment1 or external agent based and or agent less assessment using a bank of external as...

Страница 18: ...omplex because the NAC Gateway requires that an authentication method is deployed on the network and that the authenticating access edge switches are capable of dynamically authorizing end systems bas...

Страница 19: ...larity Advantage The NAC Gateway is always aware of the MAC address of the device connecting to the network and its associated IP address username and location switch IP address and port Therefore NAC...

Страница 20: ...component of the NAC solution providing comprehensive network inventory and change management capabilities for your network infrastructure RADIUS Server A RADIUS server with backend directory service...

Страница 21: ...quarantined end system without impacting IT operations Enterasys offers two types of NAC appliances The NAC Gateway appliance implements out of band network access control and requires the implementat...

Страница 22: ...Summary 1 12 Overview...

Страница 23: ...users connected to the network in order to profile and enumerate the assets on the enterprise network It is important to note that in this model the NAC solution does not play a part in authorizing a...

Страница 24: ...atures and Value There are two key pieces of functionality and value propositions supported by Model 1 End System and User Tracking Model 1 supports the ability to track end systems by MAC address as...

Страница 25: ...being assessed for security posture compliance when connecting to the network A RADIUS server is only required if out of band network access control using the NAC Gateway or inline network access cont...

Страница 26: ...ources to the end system based on device identity user identity and location For Enterasys policy enabled edge switches the NAC Gateway formats information in the RADIUS authentication messages that d...

Страница 27: ...cific location such as behind a firewall or on a particular VLAN for security reasons Physically moving the connection of these devices to an open area of the network increases the risk of these devic...

Страница 28: ...is user connects to the network In contrast a user in the IT operations group or a technician sent to repair a device on the network may be permitted unrestricted access to network resources for troub...

Страница 29: ...from any location enterprise wide If ASM reverses the quarantine action it notifies NAC Manager and the quarantine is automatically removed and the end system is dynamically re admitted access to net...

Страница 30: ...to quarantine end systems that fail assessment In fact during the initial rollout of NAC on the enterprise network it is highly recommended that end systems are not restricted access to the network i...

Страница 31: ...system the NAC Gateway can either deny the end system access to the network by sending a RADIUS access reject message to the edge switch or quarantine the end system with a highly restrictive set of...

Страница 32: ...lnerabilities present in services running on unpatched laptops are appropriately remediated so that attacks that target those vulnerabilities are not successful if they reach the device on the network...

Страница 33: ...veral reasons why both assessment models are critical to a complete NAC solution Security agents loaded onto managed end systems offer extensive assessment capabilities If an agent is required a new e...

Страница 34: ...licy Manager provides the ability to centrally define and configure the authorization levels or policies NetSight Inventory Manager is an optional component providing comprehensive network inventory a...

Страница 35: ...ng way Detection As described in Model 2 Authentication As described in Model 2 Assessment As described in Model 3 Authorization As described in Model 3 Remediation When end systems are quarantined by...

Страница 36: ...access needed services With the Enterasys NAC solution network based notification and remediation are integrated Once an end system is put into a quarantine state notification is achieved by redirect...

Страница 37: ...ware application used to monitor the health and status of infrastructure devices in the network including switches routers and Enterasys NAC appliances NAC Gateways and NAC Controllers Assessment func...

Страница 38: ...End System Authorization In addition to the values from Model 1 Location based authorization using Security Domains and Lock MAC features Special handling of end systems or users with MAC User overrid...

Страница 39: ...ssignment as defined in RFC 3580 Scenario 1 Intelligent Wired Access Edge In the intelligent wired access edge use scenario the edge switches that compose the network access layer are capable of provi...

Страница 40: ...sys NAC components work together in a network with policy enabled edge switches to provide a comprehensive NAC solution Figure 3 1 Intelligent Wired Access Edge with Enterasys Policy Enabled Devices 1...

Страница 41: ...d party switches that support RFC 3580 Figure 3 2 Intelligent Wired Access Edge with RFC 3580 Capable Devices 1 4 3 2 3 5 5 Remediation Web Page 3 Enterasys NAC Manager 3rd Party Switch RFC 3850 compl...

Страница 42: ...0 VLAN Tunnel attributes that directs the edge switch to dynamically assign a particular VLAN to the connecting end system If authentication fails and or the assessment results indicate a noncompliant...

Страница 43: ...securely contained with policy at the Matrix N series port Scenario 2 Intelligent Wireless Access Edge In the intelligent wireless access edge use scenario thick Access Points APs or wireless switche...

Страница 44: ...less Access Point 5 3 Enterasys NAC Manager Intelligent Wireless Controller RFC 3850 compliant NAC Gateway out of band appliance Assessment Server Authentication Server optionally integrated in NAC Ga...

Страница 45: ...ng on the functionality supported by the APs The following figure illustrates how the NAC Gateway and the other Enterasys NAC components provide network access control in a thick wireless deployment F...

Страница 46: ...sults For Enterasys policy enabled wireless switches and access points the NAC Gateway formats information in the RADIUS authentication messages that directs the edge switch to dynamically assign a pa...

Страница 47: ...cated on the access edge By provisioning access to network resources on the Matrix N series via MUA end system traffic destined to adjacent switches on the network can be securely contained at the Mat...

Страница 48: ...inline appliance Assessment Server Authentication Server optionally integrated in NAC Controller Role Quarantine Layer 3 Wired LAN Role Quarantine Role Quarantine Layer 2 Wired LAN Layer 2 Wireless L...

Страница 49: ...ning a policy to traffic sourced from this end system If authentication fails and or the assessment results indicate a noncompliant end system the NAC Controller can either deny the end system access...

Страница 50: ...of the end system according to predefined security policy parameters The assessment can be agent based or agent less and is executed locally by the NAC Controller s assessment functionality and or rem...

Страница 51: ...summarizes four NAC use scenarios and their NAC appliance requirements The Enterasys NAC solution is capable of implementing network access control for all four use scenarios as well as environments w...

Страница 52: ...remote access VPN tunnels into the enterprise network Appliance Requirement NAC Controller Inline network access control is implemented by deploying the NAC Controller appliance to locally authorize c...

Страница 53: ...maintained over time for each device on the network yielding complete historical information about a device as it interacts with the network Model 2 End System Authorization Enterasys NAC detects auth...

Страница 54: ...and authorization of connecting end systems The NAC Gateway effects the assignment of policies or VLANs on Enterasys switches or RFC 3580 capable switches located at edge of the network to authorize...

Страница 55: ...d party are also part of the intelligent edge of the network because they are able to authenticate and authorize connecting end systems with a particular level of network access using dynamic VLAN ass...

Страница 56: ...entication Configuration For a network with an intelligent edge the second step in surveying your network is to evaluate the network authentication method currently being used and how the deployment o...

Страница 57: ...backend RADIUS server without requiring complex configuration changes to the RADIUS server and associated directory services In addition NAC can also be configured to locally authorize MAC authenticat...

Страница 58: ...bilities When authentication is configured on the network it is important to consider end system capabilities and their ability to interact with the authentication process Machine centric end systems...

Страница 59: ...entication and authorization of over 2000 users and devices per port providing the highest degree of authentication method configuration flexibility The SecureStack C2 C3 and B2 B3 User IP Phone authe...

Страница 60: ...f band NAC using the NAC Gateway appliance leverages policy on Enterasys switches to securely authorize connecting end systems RFC 3580 capable switches can be used for authentication and authorizatio...

Страница 61: ...ually authenticating and uniquely authorizing multiple devices connected to a single port Most of the security benefits of out of band NAC using Enterasys policy can be obtained by implementing author...

Страница 62: ...for remote users If the NAC Gateway is implemented at the main site then it is important to consider what impact a WAN link disconnection would have on the NAC process and remote end system connectivi...

Страница 63: ...ent requirements 1 Identify the intelligent edge in your network if it exists This information will be used to help you select which NAC appliance the NAC Gateway or NAC Controller best suits your net...

Страница 64: ...ms If the network infrastructure does not contain intelligent devices at the edge or distribution layer then inline NAC using the NAC Controller as the authorization point for connecting end systems m...

Страница 65: ...C Manager is a plugin application to NetSight Console it is necessary to have NetSight Console installed on a server with NAC Manager NetSight Console is used to monitor the health and status of devic...

Страница 66: ...or each area of the network that has its own unique requirements for end system authentication assessment and authorization A Security Domain defines a set of NAC Gateways and NAC Controllers that hav...

Страница 67: ...default NAC configuration that defines the authentication assessment and authorization parameters for all end systems connecting in that domain A Security Domain can also include MAC or user override...

Страница 68: ...on file that determines end system compliance with the SANS Top 20 vulnerabilities The same Nessus server can be used to assess Windows machines for Windows related vulnerabilities and also assess MAC...

Страница 69: ...he network a scoring override can be configured to associate a high risk score if Wireshark is detected on an end system Which end systems are quarantined NAC Manager uses risk levels to determine whe...

Страница 70: ...AC 5 6 Design Procedures The following figure shows the NAC Manager window used to create or edit a NAC Configuration and define its authentication assessment and authorization attributes Figure 5 3 N...

Страница 71: ...of RADIUS authentication requests to a RADIUS server If the RADIUS server returns a policy or VLAN based on user or end system identity uncheck Replace RADIUS Attributes with Accept Policy Otherwise...

Страница 72: ...rk These measures limit the network exposure to security threat propagation and protect against network instability In NAC Manager create a Security Domain with the following configuration attributes...

Страница 73: ...xy RADIUS Request to a RADIUS Server radio button selected check the Replace RADIUS Attributes with Accept Policy option and specify a non restrictive policy or VLAN in the Accept Policy field This al...

Страница 74: ...e mail servers web servers or PCs running a specific OS Microsoft 2003 Server Microsoft XP RedHat Linux MAC OS This requires that the Security Domain be associated to an Assessment Configuration that...

Страница 75: ...ng attribute The Use Assessment Policy While Assessing checkbox is not selected In this case NAC Manager assigns the policy or VLAN returned from the RADIUS server or the locally defined Accept Policy...

Страница 76: ...cular Security Domain A global override lets you specify how an end system is authenticated assessed and authorized whenever the end system connects to any Security Domain on the network Use the netwo...

Страница 77: ...3 The following figure displays the windows used for MAC and user override configuration in NAC Manager Notice that either an existing NAC Configuration can be used or a custom configuration can be sp...

Страница 78: ...all Security Domains for the MAC override scope For the assessment authentication and authorization configuration choose a NAC Configuration or specify a custom configuration with the following parame...

Страница 79: ...rize MAC Authentication Requests Locally so MAC authentication attempts by these devices are assigned the Accept Policy Check Replace RADIUS Policy with Accept Policy so the policy information returne...

Страница 80: ...access It is important to note that the Layer 3 NAC Controller may not determine the true MAC address of the downstream connected end system In this case a MAC override configured in NAC A device or...

Страница 81: ...ssessment servers added for load balancing and scalability purposes The same assessment server can be used for multiple Security Domains and each assessment server can assess end systems using differe...

Страница 82: ...uration An assessment server utilizes third party assessing software to execute scans against connecting end systems and this software must be locally configured with the security assessment parameter...

Страница 83: ...AC authentication The types of users connecting to the network It is necessary to understand how authentication affects the different type of users connecting to the network and what implications this...

Страница 84: ...TAG ITA appliances then the formula would be 9000 3000 3 required ITA appliances For each switch in a particular Security Domain the maximum number of authenticating end systems that may be connected...

Страница 85: ...ng the secondary NAC Gateway is the same model as the primary The secondary NAC Gateway is not configured as a primary NAC Gateway for any switch on the network and therefore is inactive until a prima...

Страница 86: ...y to the NAC Gateway over UDP IP and the NAC Gateway in turn communicates to a backend RADIUS server Therefore the only requirement for NAC Gateway placement is that a routable IP forwarding path exis...

Страница 87: ...on of user device network login credentials on the network If 802 1X web based or RADIUS authentication for switch management logins is implemented a RADIUS server with backend directory services must...

Страница 88: ...e NAC is deployed on the network each Enterasys switch in the intelligent edge of the network must be configured with the appropriate policy roles that may be returned from the NAC Gateways A list of...

Страница 89: ...locally by the NAC Gateway and when an end system has passed an assessment if an assessment was required or if the Accept Policy has been configured to replace the Filter ID information returned in t...

Страница 90: ...server will not detect the FTP vulnerabilities on the end system To achieve this trade off the Assessing policy role can be configured by default to deny all traffic and be associated to classificatio...

Страница 91: ...es are configured to allow access to the appropriate network resources for communication with the assessment servers during assessment This can be implemented by associating the Assessing service show...

Страница 92: ...re with steps specifically relating to the implementation of inline NAC with the NAC Controller 1 Determine NAC Controller Location Because the NAC Controller is placed inline with traffic sourced fro...

Страница 93: ...it should be understood that some advantages exist with the deployment of a Layer 2 NAC Controller over a Layer 3 NAC Controller which may affect the decision of how NAC Controllers are positioned Whi...

Страница 94: ...ed NAC Controllers of that type per Security Domain The configuration of NAC Controller redundancy To achieve redundancy at each location in the network where the NAC Controller is positioned an addit...

Страница 95: ...are positioned on either side of the NAC Controllers Redundant Layer 3 NAC Controllers are active active in that traffic from a downstream router may pass through either of the redundant Layer 3 NAC...

Страница 96: ...n be selected as the Failsafe Policy in the NAC Configuration The Enterprise User policy role is fairly open permitting most types of communication onto the network For security purposes the Enterpris...

Страница 97: ...rking environments with IDS technologies that detect real time security events on the network While end system assessment determines the security posture of connecting devices and mitigates threats po...

Страница 98: ...Additional Considerations 5 34 Design Procedures...

Отзывы:

Нет отзывов