Novell ZENworks Network Access Control 5.0, Руководство пользователя

Страница: 236 / 534

236 Novell ZENworks Network Access Control Users Guide
no
vd
ocx
(e
n)
24
Ma
rch 20
09
5 The AP (authenticator) passes the identity on to the authentication server.
6 The authentication server performs the authentication and returns an accept or reject message
to the AP (authenticator).
7 The AP (authenticator) allows or blocks the client’s (supplicant’s) access to the network by
controlling which ports are open or closed.
Figure 11-1
802.1X Components
11.2 Novell ZENworks Network Access Control
and 802.1X
When configured as 802.1X-enabled, Novell ZENworks Network Access Control can be installed
with three different configurations depending on your network environment:
Š Microsoft IAS and Novell ZENworks Network Access Control IAS Plug-in
With this method, the switch is configured with the IAS server IP address as the RADIUS
server host. When the switch performs the RADIUS authentication, IAS authenticates the user.
If successful, IAS then calls the Novell ZENworks Network Access Control plug-in, which
asks Novell ZENworks Network Access Control for the health status of the endpoint. You can
configure up to six Novell ZENworks Network Access Control server URLs. The plug-in reads
the list of servers over and over (iterates) attempting to connect to one of them. Once a
connection is made, the Novell ZENworks Network Access Control plug-in uses that server
URL until it is no longer available, at which point it iterates over the list of servers again. If
necessary, the Novell ZENworks Network Access Control plug-in overwrites the RADIUS
attributes to specify the VLAN to place the endpoint into. IAS then returns the results to the
switch.
Š
Proxying RADIUS requests to an existing RADIUS server
With this method, the switch is configured with the Novell ZENworks Network Access Control
IP address as the RADIUS server host. When the switch performs the RADIUS authentication
against the Novell ZENworks Network Access Control server, Novell ZENworks Network
Access Control proxies the request to another RADIUS server. As long as that server supports
the appropriate authentication methods used by the client it should allow and authenticate the
proxied requests. On successful authentication, when the end RADIUS server returns the