Page 3 - Notice; Documentation
i Notice Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and its web site without prior notice. The reader should in all cases consult Enterasys Networks to determ...
Page 5 - Contents; About This Guide
iii Contents About This Guide Intended Audience ............................................................................................................................................ viiRelated Documents .............................................................................................
Page 6 - Chapter 3: Use Scenarios
iv Chapter 3: Use Scenarios Scenario 1: Intelligent Wired Access Edge ..................................................................................................... 3-1 Policy-Enabled Edge ...........................................................................................................
Page 9 - Intended Audience; Overview; NAC Deployment Models; Use Scenarios; Design Planning; Design Procedures
Enterasys NAC Design Guide vii About This Guide The NAC Design Guide describes the technical considerations for the planning and design of the Enterasys Network Access Control (NAC) solution. The guide includes the following information: Intended A...
Page 10 - Getting Help
Getting Help viii About This Guide • Enterasys NAC Manager Online Help. Explains how to use NAC Manager to configure your NAC appliances, and to put in place authentication and assessment requirements for the end ‐ systems accessing your ne...
Page 11 - Key Functionality; Detection
Enterasys NAC Design Guide 1-1 1 Overview This chapter provides an overview of the Enterasys Network Access Control (NAC) solution, including a description of key NAC functions and deployment models. It also introduces the required and option...
Page 12 - Assessment; Deployment Models
NAC Solution Overview 1-2 Overview Assessment Determine if the device complies with corporate security and configuration requirements, such as operating system patch revision levels and antivirus signature definitions. Other security compliance requi...
Page 13 - Model 1: End-system Detection and Tracking
NAC Solution Overview Enterasys NAC Design Guide 1-3 Model 1: End-system Detection and Tracking This NAC deployment model implements the detection piece of NAC functionality. It supports the ability to track users and end ‐ systems over time by identifyi...
Page 14 - NAC Solution Components; The NAC Appliance
NAC Solution Components 1-4 Overview NAC Solution Components This section discusses the required and optional components of the Enterasys NAC solution, beginning with the following table that summarizes the component requirements for each of the ...
Page 15 - NAC Gateway Appliance
NAC Solution Components Enterasys NAC Design Guide 1-5 Enterasys offers two types of NAC appliances: the NAC Gateway appliance implements out ‐ of ‐ band network access control, and the NAC Controller appliance implements inline network access contro...
Page 17 - Appliance Comparison; Table 1-2 Comparison of Appliance Functionality
NAC Solution Components Enterasys NAC Design Guide 1-7 Appliance Comparison The following table compares how the two NAC appliance types implement the five NAC functions. Table 1-2 Comparison of Appliance Functionality NAC Function NAC Gateway NAC Controller Detection RAD...
Page 18 - Table 1; Table 1-3 Comparison of Appliance Advantages and Disadvantages
NAC Solution Components 1-8 Overview Table 1 ‐ 3 outlines the advantages and disadvantages of the two appliance types as they pertain to network security, scalability, and configuration/implementation. Table 1-3 Comparison of Appliance Advantages and Disadvantag...
Page 19 - NetSight Management; NetSight NAC Manager; Features
NAC Solution Components Enterasys NAC Design Guide 1-9 NetSight Management The NAC appliances are configured, monitored, and managed through management applications within the Enterasys NetSight Suite. NetSight is a family of products comprised of NetS...
Page 20 - NetSight Console; RADIUS Server; Summary; detection
Summary 1-10 Overview NetSight Console NetSight Console is used to monitor the health and status of infrastructure devices in the network, including switches, routers, Enterasys NAC appliances (NAC Gateways and NAC Controllers) as well as o...
Page 23 - Implementation
Enterasys NAC Design Guide 2-1 2 NAC Deployment Models This chapter describes the four NAC deployment models and how they build on each other to provide a complete NAC solution. The first model implements a subset of the five key NAC fu...
Page 24 - Features and Value; End-System and User Tracking
Model 1: End-System Detection and Tracking 2-2 NAC Deployment Models RADIUS Access ‐ Accept or Access ‐ Reject message received from the upstream RADIUS server, is returned without modification to the access edge switch, to permit end ‐ system access t...
Page 25 - Required and Optional Components; Table 2-1 Component Requirements for Detection and Tracking
Model 2: End-System Authorization Enterasys NAC Design Guide 2-3 and information on the network. Enterasys NAC can be leveraged to provide information to SIM solutions, by mapping an IP address to an identity, such as a MAC address or usern...
Page 26 - Inline NAC
Model 2: End-System Authorization 2-4 NAC Deployment Models device identity, user identity, and/or location information is used to authorize the connecting end ‐ system with a certain level of network access. It is important to note that in thi...
Page 27 - Location-Based Authorization
Model 2: End-System Authorization Enterasys NAC Design Guide 2-5 The NAC Controller may either deny the end ‐ system access to the network or assign the end ‐ system to a particular set of network resources by specifying a particular policy. Feat...
Page 28 - User-Based Authorization
Model 2: End-System Authorization 2-6 NAC Deployment Models is only provisioned by the Enterasys NAC solution when the devices connect to switches in the Network Operations Center (NOC). This level of granularity in provisioning access to conne...
Page 29 - Table 2-2 Component Requirements for Authorization
Model 2: End-System Authorization Enterasys NAC Design Guide 2-7 a password in the registration web page. This sponsor username and password can be validated against an existing database on the network to authenticate the sponsor ʹ s identity. Sp...
Page 30 - Model 3: End-System Authorization with Assessment
Model 3: End-System Authorization with Assessment 2-8 NAC Deployment Models A RADIUS server is only required if out ‐ of ‐ band network access control using the NAC Gateway, or inline network access control using the Layer 2 NAC Controller, is im...
Page 31 - Authorization
Model 3: End-System Authorization with Assessment Enterasys NAC Design Guide 2-9 server is running or if the HTTP server is out ‐ of ‐ date) and client ‐ side checks (running applications, software configurations, installed operating system patches) provided...
Page 32 - Extensive Security Posture Compliance Verification
Model 3: End-System Authorization with Assessment 2-10 NAC Deployment Models Features and Value In addition to the features and values found in Model 1 and Model 2, the following are key pieces of functionality and value propositions supported by M...
Page 33 - Diverse Security Posture Compliance Verification; all
Model 3: End-System Authorization with Assessment Enterasys NAC Design Guide 2-11 • Application configuration The NAC solution can determine which services and applications are installed and enabled on the end ‐ system. Certain applications should be removed...
Page 34 - Component
Model 4: End-System Authorization with Assessment and Remediation 2-12 NAC Deployment Models Required and Optional Components This section summarizes the required and optional components for Model 3. . The NAC Gateway and NAC Controller are the NAC appliances ...
Page 36 - Self-Service Remediation
Model 4: End-System Authorization with Assessment and Remediation 2-14 NAC Deployment Models Inline NAC For inline Enterasys NAC deployments utilizing the Layer 2 or Layer 3 NAC Controller, the NAC functions are implemented in the following way: Detection ...
Page 38 - Table 2-5 Enterasys NAC Deployment Models
Summary 2-16 NAC Deployment Models Summary Enterasys supports all of the five key NAC functions: detection, authentication, assessment, authorization, and remediation. However, not all five functions need to be implemented concurrently in a NAC ...
Page 40 - Quarantine; NAC Functions
Scenario 1: Intelligent Wired Access Edge 3-2 Use Scenarios within the same Quarantine VLAN because the authorization point is usually implemented at the exit point of the VLAN via Access Control Lists (ACLs). Policy-Enabled Edge The following figure...
Page 42 - Scenario 1 Implementation
Scenario 1: Intelligent Wired Access Edge 3-4 Use Scenarios Scenario 1 Implementation In the intelligent wired edge use scenario, the five NAC functions are implemented in the following manner: 1. Detection ‐ The user ʹ s end ‐ system connects to the n...
Page 43 - Scenario 2: Intelligent Wireless Access Edge; Thin Wireless Edge
Scenario 2: Intelligent Wireless Access Edge Enterasys NAC Design Guide 3-5 intelligent edge on the network. The Matrix N ‐ series switch is capable of authenticating and authorizing multiple devices connected to a single port for a variety of netw...
Page 45 - Thick Wireless Edge
Scenario 2: Intelligent Wireless Access Edge Enterasys NAC Design Guide 3-7 Thick Wireless Edge In a thick wireless deployment, access points forward wireless end ‐ system traffic directly onto the wired infrastructure without the use of a wireless switch....
Page 46 - Scenario 2 Implementation
Scenario 2: Intelligent Wireless Access Edge 3-8 Use Scenarios Scenario 2 Implementation In the intelligent wireless access edge use scenario, the five NAC functions are implemented in the following manner: 1. Detection ‐ The user ʹ s end ‐ system connects...
Page 47 - not
Scenario 3: Non-intelligent Access Edge (Wired and Wireless) Enterasys NAC Design Guide 3-9 It is important to note that if the wireless edge of the network is non ‐ intelligent and not capable of authenticating and authorizing wireless end ‐ systems, ...
Page 48 - Layer 3 Wired LAN; Layer 2 Wired LAN
Scenario 3: Non-intelligent Access Edge (Wired and Wireless) 3-10 Use Scenarios Figure 3-5 Non-intelligent Access Edge (Wired and Wireless) 2 3 3 3 4 5 1 3 Enterasys NAC Manager NAC Controller (inline appliance) Assessment Server Authentication Server (optionally integrated in NAC Controller) Role= ...
Page 49 - Scenario 3 Implementation; Scenario 4: VPN Remote Access
Scenario 4: VPN Remote Access Enterasys NAC Design Guide 3-11 Scenario 3 Implementation In the non ‐ intelligent access edge use scenario, the five NAC functions are implemented in the following manner: 1. Detection ‐ The user ʹ s end ‐ system connects to ...
Page 50 - Figure 3-6 VPN Remote Access; Scenario 4 Implementation
Scenario 4: VPN Remote Access 3-12 Use Scenarios Figure 3-6 VPN Remote Access Scenario 4 Implementation In the VPN remote access use scenario, the five NAC functions are implemented in the following manner with the deployment of the NAC Controller for ...
Page 51 - Remediation; Table 3-1 Use Scenario Summaries; Appliance Requirement: NAC Gateway; Appliance Requirement: NAC Controller
Summary Enterasys NAC Design Guide 3-13 5. Remediation ‐ When the quarantined end user opens a web browser to any web site, its traffic is dynamically redirected to a Remediation web page that describes the compliance violations and provi...
Page 52 - Use Scenario
Summary 3-14 Use Scenarios Scenario 4: VPN remote access Summary: VPN concentrators act as a termination point for remote access VPN tunnels into the enterprise network. Appliance Requirement: NAC Controller Inline network access control is implemented by deploying the NAC Controller appliance to lo...
Page 54 - Survey the Network; Identify the Intelligent Edge of the Network
Survey the Network 4-2 Design Planning access to a web browser to safely remediate their quarantined end ‐ system without impacting IT operations. Once a deployment model is selected, the current network infrastructure must be examined to ident...
Page 55 - Figure 4; Figure 4-1 Network with Intelligent Edge
Survey the Network Enterasys NAC Design Guide 4-3 The network shown in Figure 4 ‐ 1 below, illustrates the following three examples of how the intelligent edge can be implemented in a network. • Policy ‐ enabled Enterasys devices at the physical ...
Page 56 - Figure 4-2 Network with Non-Intelligent Edge; Evaluate Policy/VLAN and Authentication Configuration; Case #1: No authentication method is deployed on the network.
Survey the Network 4-4 Design Planning For the inline implementation of the Enterasys NAC solution, the NAC Controller authenticates and authorizes end ‐ systems locally on the appliance, and does not rely on the capabilities of downstream in...
Page 57 - Overview of Supported Authentication Methods; Authentication
Survey the Network Enterasys NAC Design Guide 4-5 to locally authorize all MAC authentication requests for connecting end ‐ systems, thereby not requiring a list of known MAC addresses. In fact, Enterasys NAC can be configured in a “learning ...
Page 58 - MAC; End-System Capabilities
Survey the Network 4-6 Design Planning Similar to 802.1X, web ‐ based authentication requires the input of credentials and is normally used on user ‐ centric end ‐ systems that have a concept of an associated user, such as a PC. Therefore, ...
Page 59 - Authentication Support on Enterasys Devices
Survey the Network Enterasys NAC Design Guide 4-7 system at a time, then it is suggested that MAC locking (also known as Port Security) be enabled on the edge switches to restrict the number of connecting devices. If multiple end ‐ system...
Page 60 - Identify the Strategic Point for End-System Authorization
Survey the Network 4-8 Design Planning authenticated to the network and interact with Enterasys NAC for authentication, assessment, authorization, and remediation. Note however, that this configuration may not be possible if trusted users are a...
Page 61 - Identify Network Connection Methods; Wired LAN; Thick Wireless Deployments
Survey the Network Enterasys NAC Design Guide 4-9 If the network infrastructure does not contain intelligent devices at the edge or distribution layer, then inline NAC using the NAC Controller as the authorization point for connecting end ‐ sys...
Page 62 - Thin Wireless Deployments; Remote Access WAN
Survey the Network 4-10 Design Planning this case, the thick AP deployment falls into the category of non ‐ intelligent edge devices with the same NAC implementations as a non ‐ intelligent wired edge. These non ‐ intelligent APs must be conf...
Page 63 - Remote Access VPN; Identify Inline or Out-of-band NAC Deployment
Identify Inline or Out-of-band NAC Deployment Enterasys NAC Design Guide 4-11 Remote Access VPN In many enterprise environments, a VPN concentrator located at the main site connects to the Internet to provide VPN access to remote users. In this scena...
Page 65 - Identify Required NetSight Applications; NetSight
Enterasys NAC Design Guide 5-1 5 Design Procedures This chapter describes the design procedures for Enterasys NAC deployment on an enterprise network. The first section discusses procedures for both out ‐ of ‐ band and inline NAC deployments. The ...
Page 66 - Define Network Security Domains
Procedures for Out-of-Band and Inline NAC 5-2 Design Procedures Policy Manager is not required for out ‐ of ‐ band NAC that utilizes RFC 3580 ‐ compliant switches (Enterasys and third ‐ party switches). In this case, a VLAN is specified in NAC Mana...
Page 67 - Figure 5-1 Security Domain; NAC Configurations
Procedures for Out-of-Band and Inline NAC Enterasys NAC Design Guide 5-3 Figure 5-1 Security Domain NAC Configurations Each Security Domain has a default “NAC configuration” that defines the authentication, assessment, and authorization parameters for all end ‐ sy...
Page 68 - Figure 5-2 NAC Configuration
Procedures for Out-of-Band and Inline NAC 5-4 Design Procedures Figure 5-2 NAC Configuration Authentication The Authentication settings define how RADIUS requests are handled for authenticating end ‐ systems (this does not apply to Layer 3 NAC Controllers.) ...
Page 70 - Figure 5-3 NAC Configuration for a Security Domain
Procedures for Out-of-Band and Inline NAC 5-6 Design Procedures The following figure shows the NAC Manager window used to create or edit a NAC Configuration and define its authentication, assessment, and authorization attributes. Figure 5-3 NAC Configura...
Page 71 - Table 5-1 Security Domain Configuration Guidelines
Procedures for Out-of-Band and Inline NAC Enterasys NAC Design Guide 5-7 The following table provides examples of various network scenarios that should be considered when identifying the number and configuration of Security Domains in your NAC deploy...
Page 72 - Table 5-1 Security Domain Configuration Guidelines (continued)
Procedures for Out-of-Band and Inline NAC 5-8 Design Procedures Area of the network that provides access to a group of users or devices that pose a potentially high risk to the security or stability of the network. • Switches that provide access to guest users or contractors on a corporate network. ...
Page 74 - Network Scenario
Procedures for Out-of-Band and Inline NAC 5-10 Design Procedures The following table provides network scenarios from an assessment standpoint that should be taken into account when identifying the number and configuration of Security Domains. Table 5-2...
Page 76 - Identify Required MAC and User Overrides; MAC Overrides
Procedures for Out-of-Band and Inline NAC 5-12 Design Procedures 3. Identify Required MAC and User Overrides MAC and user overrides are used to handle end ‐ systems that require a different set of authentication, assessment, and authorization parameters from ...
Page 77 - Figure 5-4 MAC and User Override Configuration
Procedures for Out-of-Band and Inline NAC Enterasys NAC Design Guide 5-13 The following figure displays the windows used for MAC and user override configuration in NAC Manager. Notice that either an existing NAC Configuration can be used or a c...
Page 78 - Table 5-3 MAC Override Configuration Guidelines
Procedures for Out-of-Band and Inline NAC 5-14 Design Procedures The following table describes scenarios where a MAC override may be configured for a particular end ‐ system. Table 5-3 MAC Override Configuration Guidelines Network Scenario Examples Security Domain Confi...
Page 80 - User Overrides
Procedures for Out-of-Band and Inline NAC 5-16 Design Procedures User Overrides A user override lets you create a configuration for a specific end user, based on the user name. For example, you could create a user override that gives a truste...
Page 81 - Assessment Design Procedures; Determine the Number of Assessment Servers
Assessment Design Procedures Enterasys NAC Design Guide 5-17 Manager will not match this end ‐ system and the end ‐ system is assigned the Security Domain’s default NAC configuration. In addition, the Layer 3 NAC Controller is not able to deter...
Page 82 - Determine Assessment Server Location
Assessment Design Procedures 5-18 Design Procedures 2. Determine Assessment Server Location When determining the location of the assessment servers on the network, the following factors should be considered: • The type of assessment: agent ‐ less or agent ...
Page 83 - Identify Network Authentication Configuration; “Survey
Out-of-Band NAC Design Procedures Enterasys NAC Design Guide 5-19 configuration if the security vulnerability is considered a risk for the organization. For more information on Nessus, refer to http://nessus.org/ . Out-of-Band NAC Design Procedures The followi...
Page 84 - Determine the Number of NAC Gateways; Figure 5; Table 5-4 End-System Limits for NAC Gateways
Out-of-Band NAC Design Procedures 5-20 Design Procedures 2. Determine the Number of NAC Gateways The number of NAC Gateways to be deployed on the network is a function of the following parameters: • The number of Security Domains configured on the ne...
Page 85 - Figure 5-5 NAC Gateway Redundancy
Out-of-Band NAC Design Procedures Enterasys NAC Design Guide 5-21 Figure 5-5 NAC Gateway Redundancy It is important that the secondary NAC Gateway does not exceed maximum capacity if the primary NAC Gateway fails on the network. For example, let’s sa...
Page 86 - Determine NAC Gateway Location
Out-of-Band NAC Design Procedures 5-22 Design Procedures primary NAC Gateway, the transition to the secondary NAC Gateway will not exceed maximum capacity. To support redundancy within a Security Domain for either approach, one additional NAC G...
Page 87 - Identify Backend RADIUS Server Interaction
Out-of-Band NAC Design Procedures Enterasys NAC Design Guide 5-23 It is important to note that only the NAC Gateways that are configured with remediation and registration functionality need to be positioned in such a manner. All other NAC Gat...
Page 88 - VLAN Configuration
Out-of-Band NAC Design Procedures 5-24 Design Procedures 6. VLAN Configuration This step is for NAC deployments that use RFC ‐ 3580 ‐ compliant switches in the intelligent edge of the network to implement dynamic VLAN assignment of connecting devices. ...
Page 89 - Failsafe Policy and Accept Policy Configuration
Out-of-Band NAC Design Procedures Enterasys NAC Design Guide 5-25 previously specified in the NAC configuration must be defined in NetSight Policy Manager to ensure the consistent allocation of network resources to connecting end ‐ systems. Failsafe Poli...
Page 90 - Figure 5-6 Policy Role Configuration in NetSight Policy Manager; Assessment Policy
Out-of-Band NAC Design Procedures 5-26 Design Procedures Figure 5-6 Policy Role Configuration in NetSight Policy Manager Assessment Policy The Assessment Policy may be used to temporarily allocate a set of network resources to end ‐ systems while they are being ...
Page 91 - Figure 5-7 Service for the Assessing Role; Quarantine Policy
Out-of-Band NAC Design Procedures Enterasys NAC Design Guide 5-27 Figure 5-7 Service for the Assessing Role Note that it is not mandatory to assign the Assessment Policy to a connecting end ‐ system while it is being assessed. NAC can be configured to ...
Page 92 - Figure 5-8 Service for the Quarantine Role; Unregistered Policy; Inline NAC Design Procedures; Determine NAC Controller Location
Inline NAC Design Procedures 5-28 Design Procedures Figure 5-8 Service for the Quarantine Role Furthermore, the Quarantine Policy and other network infrastructure devices must be configured to implement HTTP traffic redirection for quarantined end ‐ systems to...
Page 94 - Determine the Number of NAC Controllers; Table 5-5 End-System Limits for NAC Controllers
Inline NAC Design Procedures 5-30 Design Procedures 2. Determine the Number of NAC Controllers The number of NAC Controllers to be deployed on the network is a function of the following parameters: • The network topology. Because the NAC Controller is ...
Page 95 - Figure 5-9 Layer 2 NAC Controller Redundancy; Figure 5-10 Layer 3 NAC Controller Redundancy
Inline NAC Design Procedures Enterasys NAC Design Guide 5-31 Figure 5-9 Layer 2 NAC Controller Redundancy For a Layer 3 NAC Controller, redundancy is achieved by implementing redundant Layer 3 NAC Controllers on adjacent, but separate networks as shown i...
Page 96 - Identify Backend RADIUS Server Interaction
Inline NAC Design Procedures 5-32 Design Procedures 3. Identify Backend RADIUS Server Interaction Layer 2 NAC Controllers detect downstream end ‐ systems via authentication: MAC, web ‐ based, or 802.1X. If web ‐ based or 802.1X authentication is implemented, t...
Page 97 - Additional Considerations; NAC Deployment With an Intrusion Detection System (IDS)
Additional Considerations Enterasys NAC Design Guide 5-33 assessment servers to reach the end ‐ system while it is being assessed, regardless of whether the Assessing policy, Enterprise User policy, or any other policy role is utilized for asse...
