Enterasys SNS-TAG-HPA Manual de usuario descargar pdf (Pagina 3)

Page 3

binds together the User, Hostname, IP address, MAC and location

(switch and port or wireless AP and SSID) along with timestamps for

each endpoint—a key requirement for auditing and forensics. IP-to-ID

Mapping is also used by NMS Automated Security Manager to implement

location-independent distributed intrusion prevention and by Enterasys

Security Information and Event Manager (SIEM) or other third party

SIEM/IPS solutions to pinpoint the source of a threat.

Enterasys NAC Inline Controller

The Enterasys NAC Inline Controller may be integrated into any network

from any vendor to provide network access control for wired LAN,

wireless LAN, and VPN users. The Enterasys NAC Inline Controller may

be deployed without reconﬁguration of network edge infrastructure. An

in-line appliance, Enterasys NAC supports up to 2,000 endpoints and

addresses a number of out-of-band NAC deployment challenges:

• Out-of-band NAC requires intelligent edge switches that support IEEE

802.1X authentication and RFC 3580 quarantine. Enterasys and

some third party switches meet these requirements, but many older

edge switches do not. The Enterasys NAC Inline Controller provides

authentication and isolation for each user and application ﬂow

regardless of the edge switch deployed.

• Out-of-band NAC often requires reconguration of edge switches. The

Enterasys NAC Inline Controller is installed in-line between the edge

and distribution layers, and does not require any reconﬁguration at the

network edge.

Network performance and network fail-over availability are two important

issues to consider when deploying any in-line security appliance.

Because Enterasys NAC Inline Controllers take advantage of Enterasys

advanced switch technology, these appliances will not become

congestion points on the network. Dual Enterasys NAC Inline Controllers

can be deployed in a fail-over mode where redundancy is required. Each

communicates with the NMS NAC Manager application to replicate

status and conﬁguration information.

Assessment for the NAC Inline Controller is separately licensed and

includes both agent-based and agent-less assessment.

Enterasys NAC Out-of-Band Gateway

The Enterasys NAC Out-of-Band Gateway controls endpoint

authentication, security posture assessment and network authorization.

For authentication services, the Enterasys NAC Out-of-Band Gateway

acts as a RADIUS proxy, or RADIUS server for MAC Authentication,

which communicates with the organization’s RADIUS authentication

services (e.g. interfaces with Microsoft Active Directory or another

LDAP-based directory service). The Enterasys NAC Out-of-Band Gateway

supports 802.1X (Extensible Authentication Protocol), MAC, Web-based

and Kerberos Snooping (with certain restrictions) authentication. For

endpoint assessment, the Enterasys NAC Out-of-Band Gateway connects

to multiple security assessment servers.

For authorization services, the Enterasys NAC Out-of-Band Gateway

communicates RADIUS attributes to the authenticating switch. This

allows the switch to dynamically authorize and allocate network resources

to the connecting endpoint based on authentication and assessment results.

The Enterasys NAC Out-of-Band Gateway appliance also stores NAC

conﬁguration information and the physical location of each endpoint.

It easily scales to support redundancy and large NAC deployments.

Enterasys NAC Out-of-Band Gateway models are available to meet

the needs of different-sized implementations. It is also available as a

security module for popular Enterasys switches.

Assessment for the NAC Out-of-Band Gateway is separately licensed and

includes both agent-based and agent-less assessment.

Enterasys NAC Out-of-Band Gateway Virtual Appliance

Enterasys NAC Out-of-Band Gateway Virtual Appliance provides all the

powerful endpoint authentication, security posture assessment and

network authorization capabilities built on VMware®. Deploying NAC

Out-of-Band Gateway Virtual Appliance, enterprises gain all the benets

of network access control with the advantages of a virtual environment

—cost savings from using existing hardware and reduced time to value.

Available with different sizing options for central locations as well as

remote sites.

Assessment for NAC Virtual Appliance is separately licensed and includes

both agent-based and agent-less assessment.

Additional Features

• Proven interoperability with Microsoft NAP and Trusted Computing

Group TNC.

• Automatic endpoint discovery and location tracking by identifying

new MAC addresses, new IP addresses, new 802.1X / Web-based

authentication sessions, or Kerberos or RADIUS request from access

switches.

• Support for Layer 2 and Layer 3 deployment modes and support for

all ﬁve NAC deployment models: intelligent wired edge, intelligent

wireless edge, non-intelligent wired edge, non-intelligent wireless

edge, and VPN.

• Management options (in-band or out-of-band) can be tailored to

existing network management schemes and security requirements.

• Support for multiple RADIUS and LDAP server groups allows

administrators to identify the server to which a request is directed.

• Macintosh agent support for agent-based assessment.

• Open XML API’s support integration with IT workows for automated

streamlined operations

• Web-service based NAC API simplies integration with third party

applications.

• 1 + 1 Redundancy for both Layer 2 and Layer 3 deployment modes:

provides high-availability and eliminates the NAC Inline Controller or

NAC Out-of-Band Gateway as a single point of failure

• Risk level conguration allows exibility in determining threat

presented by the end system. Fine grained control allows NAC

administrator to deﬁne High Risk, Medium Risk, and Low Risk

thresholds based on local security policies and concerns.

• The Enterasys NAC Inline Controller and NAC Out-of-Band Gateway

are upgradable, allowing assessment to be integrated onto a single box

with the other NAC functions. The upgraded appliances are capable of

supporting both network-based and/or agent-based assessment.

1 2 3 4 5 6

Comentarios a estos manuales

Sin comentarios

Enterasys SNS-TAG-HPA Manual de usuario Pagina 3

Comentarios a estos manuales

Relacionado con productos y manuales para Redes Enterasys SNS-TAG-HPA