Enterasys-networks 9034385 Instrukcja Użytkownika Pobierz pdf (Strona 91)

Out-of-Band NAC Design Procedures

Enterasys NAC Design Guide 5-27

Figure 5-7 Service for the Assessing Role

NotethatitisnotmandatorytoassigntheAssessmentPolicytoaconnectingend‐systemwhileit

isbeingassessed.NACcanbeconfiguredtoassignthepolicyrolereceivedfromtheRADIUS

serverortheAcceptPolicytotheend‐systemwhileitisbeingassessed.Inthis

way,theend‐

systemcanbegrantedimmediatenetworkaccesswithoutmandatingthattheenduserwaitfor

assessmenttobecomplete beforefullnetworkresourceallocationisgranted.IfNACisconfigured

toreturnthepolicyrolereceivedfromtheRADIUSServer,itisnecessarythattheenterpriseʹs

business

‐specificpolicyrolesareconfiguredtoallowaccesstotheappropriatenetworkresources

forcommunicationwiththeassessmentserversduringassessment.Thiscanbeimplementedby

associatingtheAssessingserviceshowninFigure 5‐7toallbusiness‐specificpolicyrolesinthe

NetSightPolicyManagerconfiguration.

Quarantine Policy

TheQuarantinePolicyisusedtorestrictnetworkaccesstoend‐systemsthathavefailed

assessment.ForEnterasyspolicy‐enabledswitches,acorrespondingQuarantinepolicyrole

(createdinPolicyManager)shoulddenyalltrafficbydefaultwhilepermittingaccesstoonly

requirednetworkresourcessuchasbasicnetworkservices(ARP,DHCP,

andDNS).

IftheNACdeploymentimplementsremediation,theservicesassociatedtotheQuarantinePolicy

mustbeconfiguredtoallowallHTTPtrafficontothenetwork,inadditiontootherbasicIP

servicessuchasARP,DNS,and DHCPasshowninFigure 5 ‐8.

1 2 ... 86 87 88 89 90 91 92 93 94 95 96 97 98

Brak uwag

Enterasys-networks 9034385 Instrukcja Użytkownika Strona 91