Enterasys-networks 9034385 Instrukcja Użytkownika Pobierz pdf (Strona 47)

Scenario 3: Non-intelligent Access Edge (Wired and Wireless)

Enterasys NAC Design Guide 3-9

Itisimportanttonotethatifthewirelessedgeofthenetworkisnon‐intelligentandnotcapableof

authenticatingandauthorizingwirelessend‐systems,itispossibletoaugmentthenetwork

topologytoimplementout‐of‐bandNACwiththeNACGateway.Thiscanbeaccomplished

withoutreplacingthe

physicaledgeofthenetwork,byaddinganintelligentedgeswitchthat

possessesspecializedauthenti cationandauthorizationfeat ures.

TheEnterasysMatrixN‐seriesswitchiscapableofauthenticatingandauthorizingnumerousend‐

systemsconnectedonasingleportthroughMulti‐UserAuthentication (MUA),andmaybe

positionedupstreamfromnon‐

intelligentthird‐partywirelessAPstoactastheintelligentedgeon

thenetwork.TheEnterasysMatrixN‐seriesswitchiscapableofauthenticatingandauthorizing

over1000end‐systemsuplinkedtoasingleMatrixN‐seriesportfromanAP,asetofAPs,or

wirelessswitches.Inthisconfiguration,

theMatrixN‐seriesactsastheintelligentedgeswitchon

thenetwork,althoughnotphysicallylocatedontheaccessedge.Byprovisioningaccessto

networkresourcesontheMatrixN‐seriesviaMUA,end‐systemtrafficdestinedtoadjacent

switchesonthenetworkcanbesecurelycontainedatthe

MatrixN‐seriesport.

Scenario 3: Non-intelligent Access Edge (Wired and Wireless)

Inthenon‐intelligentaccessedgeusescenario,theedgeswitchesandaccesspointsthatcompose

thenetworkaccesslayerarenotcapableofauthenticatingandauthorizingtheconnectingend‐

systemsonthenetwork.

Inthisscenario,inlineNACisimplementedbypositioningtheNACControlleratastrategicpoint

in

thenetworktopology,astheauthorizationpointforend‐systemtrafficenforcement.

TheNACControllermaybepositioneddirectlywithintheVLANwhereend‐systemsare

connectedoracrossoneormoreroutedboundaries.WhentheNACControllerispositioned

withintheVLANwhereend‐systemsareconnected,eachdeviceis

uniquelyidentifiedbyits

associatedMACaddress.WhentheNACControllerispositionedacrossaroutedboundary(for

example,behindaWANrouterlocatedinanenterpriseʹscentralsite),eachend‐systemis

identifiedbyitsassociatedIPaddress.

ThefollowingfigureillustrateshowtheNACControllerandtheother

EnterasysNAC

componentsworktogetherinthenon‐intelligentedgetoprovidenetworkaccesscontrol.

1 2 ... 42 43 44 45 46 47 48 49 50 51 52 ... 97 98

Brak uwag

Enterasys-networks 9034385 Instrukcja Użytkownika Strona 47