Enterasys-networks 9034385 Instrukcja Użytkownika Strona 61

  • Pobierz
  • Dodaj do moich podręczników
  • Drukuj
  • Strona
    / 98
  • Spis treści
  • BOOKMARKI
  • Oceniono. / 5. Na podstawie oceny klientów
Przeglądanie stron 60
Survey the Network
Enterasys NAC Design Guide 4-9
Ifthenetworkinfrastructuredoesnotcontainintelligentdevicesattheedgeordistributionlayer,
theninlineNACusingtheNACControllerastheauthorizationpointforconnectingendsystems
mustbeimplemented.ThisisnotassecureasoutofbandNACbecausetheauthorizationpoint
forendsy stemsis
locateddeeperintothenetworkattheNACController.WithinlineNAC,a
quarantinedendsystem,whilerestrictedfromnetworkaccesstoresourcesupstreamfromthe
NACController,isstillabletointeractopenlywithresourcesandassetsonthenetwork
downstreamfromtheNACController.However,anadvantageof
theNACControlleristhatit
providesnetworkaccesscontrolwithoutrequiringtheupgradeoftheaccesslayerordistribution
layerofthenetwork.
Furthermore,itisimportanttonotethattheNACControllerandNACGatewaycanbedeployed
concurrentlyinthenetworkforthesimultaneousimplementationofinlineand
outofbandNAC,
allcentrallymanagedfromtheNetSightNACManager.TheNACGatewaycanbeutilizedfor
areasofthenetworkwhereintelligentswitchesreside,whiletheNACControllercanbe
positionedinlineforsegmentsofthenetworkwherenonintelligentdevicesexist.
Ifthedeploymentofoutof
bandNACisdesiredforanetworkwithnonintelligentaccesslayer
devices,thefollowingoptionsshouldbeconsidered:
DistributionlayerinfrastructuredevicescanbestrategicallyupgradedtoEnterasysMatrixN
Seriesdevicesthatarecapableofindividuallyauthenticatinganduniquelyauthorizing
multipledevicesconnectedtoasingleport.Mostof
thesecuritybenefitsofoutofbandNAC
usingEnterasyspolicycanbeobtainedbyimplementingauthorizationatthedistribution
layerinsteadofatthe portofconnectionintheaccesslayer.
AccesslayerinfrastructuredevicescanbeupgradedtoEnterasyspolicycapableswitchesor
RFC3580capableswitches to
obtainthesecuritybenefitsofoutofbandNAC.
4. Identify Network Connection Methods
ThepreviousstepshavebeenconcernedwithimplementingNACfortheinternalLAN.Inthis
step,varioustypesofnetworkconnectionmethodsarediscussed,alongwiththeirimpactonNAC
deployment.
Wired LAN
OutofbandorinlineNACcanbeimplemented,dependingonthecapabilitiesoftheaccessedge
infrastructuredevices.
Wireless LAN
WirelessLANdeploymentsmaybecategorizedintoeitherthickwirelessdeploymentswhere
accesspoints(APs)operateind e pend entlyonthenetwork,orthinwirelessdeploymentswhere
APscommunicatebacktocentrallydeployedwirelessswitchesthatfacilitatecommunication
betweenAPs.
Thick Wireless Deployments
ThickwirelessdeploymentsmayconsistoffullfeaturedAPsthatsupportauthenticationand
authorization.FullfeaturedthickAPsfallintotheintelligentedgecategoryandhavethesame
NACimplicationsasanintelligentwirededge.Inthiscase,intelligentAPsinathickwireless
deploymentcanbeconfiguredwithoutof
bandNACusingtheNACGateway,with
authenticationandauthorizationimplementedonthethickAPs.
OtherthickAPdeploymentsmayconsistofAPsthatdonotsupportauthenticationand/or
authorizationandmerelyactasamediaconverterbetweenthewirelessandwirednetworks.In
Przeglądanie stron 60
1 2 ... 56 57 58 59 60 61 62 63 64 65 66 ... 97 98

Komentarze do niniejszej Instrukcji

Brak uwag