Enterasys-networks 9034385 Manual de usuario descargar pdf (Pagina 81)

Assessment Design Procedures

Enterasys NAC Design Guide 5-17

Managerwillnotmatchthisend‐systemandtheend‐systemisassignedtheSecurityDomain’s

defaultNACconfiguration.Inaddition,theLayer3NACControllerisnotabletodeterminethe

usernameassociatedtothedownstreamend‐systemformatchingagainstuseroverrides,andthe

end‐systemisassignedthe

SecurityDomain’sdefaultNACconfiguration.

Assessment Design Procedures

ThefollowingsectionprovidesthedesignproceduresforimplementingassessmentinyourNAC

deployment.

1. Determine the Number of Assessment Servers

AssessmentserversareusedtoimplementassessmentfunctionalityinNACdeployments.Usethe

followingparameterstodeterminethenumberofrequiredassessmentserversforyour

deployment:

•Load‐sharingrequirements.

Morethanoneassessmentservermayberequiredtohandlethe numberofend‐systemsbeing

assessedatanyonetime.Thenumber

ofend‐systemsthatcanbeassessedatthesametime

andtheamountoftimerequiredtocompleteanassessmentisdeterminedbythenumberof

vulnerabilitiesbeingassessed,throughputlimitationsonthenetwork,andthehardware

specificationsoftheassessmentservermachine.Load‐sharingofend‐systemassessment

is

implementedinaroundrobinfashionbetweentheassessmentserversavailableinthe

assessmentresourcepool.

• Assessmentserverredundancy.

Toprovideredundancy,atleasttwoassessmentserversshouldbeconfiguredperNAC

deployment,withadditionalassessmentserversaddedforload‐balancingandscalability

purposes.

Thesameassessmentservercanbeused

formultipleSecurityDomains,andeachassessment

servercanassessend‐systemsusingdifferentsetsofassessmentparameters,dependingonthe

device,user,orlocationisinthenetwork.Herearesomeexamples:

•Ifguests andotheruntrustedusersaretobeassessedforadifferentsetofsecurity

vulnerabilitiesthan

trustedusers,aSecurityDomaincanbeassociatedtotheareasofthe

networkwhereuntrustedusersconnect,andcanspecifyanAssessmentConfigurationthat

usesassessmentserversconfiguredfortheassessmentofuntrustedusers.Iftrustedusers

connecttothissameSecurityDomain,anotherAssessmentConfigurationthatleverages

assessment

serversconfiguredtoassessvulnerabilitiesoftrusteduserscanbeutilized.Note

thatifseveralSecurityDomainsrequirethesameassessmentparameters,thentheseSecurity

DomainscanbeconfiguredtousethesameAssessmentConfiguration.

•Ifacertaintypeofend‐system (forexample,anend‐systemofaparticularmodel,

havinga

particularOS,andrunningspecificservices)connectstothenetworkinacertainarea,oris

identifiedbyMACaddress,aSecurityDomainandMACoverridecanbeassociatedtothis

areaofthenetworkthatusesanAssessmentConfigurationthatleveragesassessmentservers

thatassessvulnerabilitiesspecificto

thattypeofend‐system.Forexample,anareaofthe

networkwhereMicrosoftIASserversconnectorwherePolycomIPphonesconnectcanbe

configuredtoutilizeanassessmentserverconfiguredtoscanforMicrosoftIASwebserver‐

relatedvulnerabilitiesorPolycomIPphonedefaultsettings.

1 2 ... 76 77 78 79 80 81 82 83 84 85 86 ... 97 98

Comentarios a estos manuales

Sin comentarios

Enterasys-networks 9034385 Manual de usuario Pagina 81

Comentarios a estos manuales

Relacionado con productos y manuales para Herramientas Enterasys-networks 9034385