Enterasys-networks 9034385 Manual de usuario descargar pdf (Pagina 94)

Inline NAC Design Procedures

5-30 Design Procedures

2. Determine the Number of NAC Controllers

ThenumberofNACControllerstobedeployedonthenetworkisafunctionofthefollowing

parameters:

•Thenetworktopology.

BecausetheNACControllerisplacedinlinewithtrafficsourcedfromconnectingend‐

systems,thenumberofNACControllersrequiredisdirectlydependentonthenetwork

topology.Afterthelocationof

theNACControllerisidentifiedfromthenetworktopology,the

minimumnumberofNACControllerscanbedetermined.

•ThenumberofSecurityDomainsconfiguredonthenetwork.

EachNACControllercanbeassociatedtoonlyoneSecurityDomain.Therefore,thenumber

ofNACControllersdeployedonthenetworkwillbegreater

thanorequaltothenumberof

SecurityDomainsconfiguredinNACManager.TosupportredundancyperSecurityDomain,

atleasttwoNACControllersmustbedeployedperSecurityDomain,asdiscussedbelow.

•ThenumberofusersanddevicesthatareconnectedtoeachSecurityDomain.

EachNACControllerappliancehasthe

capabilityofsupportingupto2000end‐systems

connecteddownstreamasshowninthefollowingtable.

ToidentifytheminimumnumberofNACControllersrequiredtosupportinlineNAC,usethe

followingformula:

Numberofconnectingend‐systemsinaSecurityDomain/Concurrentend‐systems

supportedbycontrollertype=

thenumberofrequiredNACControllersofthattype,per

SecurityDomain.

•TheconfigurationofNACControllerredundancy.

ToachieveredundancyateachlocationinthenetworkwheretheNACControlleris

positioned,anadditionalNACControllerisrequired,essentiallydoublingthetotalnumberof

requiredNACControllers.Redundancyimplementationdiffers

betweenLayer2andLayer3

Controllers.

ForaLayer2NACController,redundancyisachievedintwodifferentways.Redundancyfor

theNACPolicyEnforcementPoint(PEP)componentoftheNACControllerisachievedby

implementing802.1w/sspanningtreebetweentheredundantNACControllersasshownin

Figure 5‐9on

page 5‐31.RedundantLayer2NACControllersareactive‐passivewhenonly

onespanningtreeforoneVLANisconfiguredbetweentheNACControllers,andareactive‐

activewhenmultiplespanningtreesformultipleVLANsareconfiguredbetweenthe

redundantNACControllers.IfNACController#1ʹsPolicyEnforcementPoint(PEP)

stops

forwardingtraffic,thenetworkwillautomaticallyconvergevia802.1w/sspanningtreeto

forwardtrafficthroughNACController#2.

RedundancyfortheNACEnginecomponentoftheNACControllerisachievedbythe

redundantNACControllersusingeachotherasbackupRADIUSservers.IfNACController

#1ʹsEnginestops

processingRADIUSauthenticationrequests,theredundantNACEngine

willtakeoverprocessingRADIUSmessagesasshowninFigure 5‐9onpage 5‐31.

Table 5-5 End-System Limits for NAC Controllers

NAC Controller Model Concurrent End-Systems Supported

7S4280-19-SYS Up to 2000

2S4082-25-SYS Up to 2000

1 2 ... 89 90 91 92 93 94 95 96 97 98

Comentarios a estos manuales

Sin comentarios

Enterasys-networks 9034385 Manual de usuario Pagina 94

Comentarios a estos manuales

Relacionado con productos y manuales para Herramientas Enterasys-networks 9034385