1 Network Admission Control: A Survey of Approaches Educause 2008George Finney, J.D. Director of Digital Interests Southern Methodist University Thursday, October 30th, 2008 October 30th, 2008 Southern Methodist University

2 Southern Methodist UniversityWhat Is it? October 30th, 2008 Southern Methodist University

3 Southern Methodist UniversityBackground SMU began using NetReg in the late 1990’s for our Dorm and Wireless Networks. In 2004, SMU replaced the NetReg product with a commercial solution. In 2007, as a part of the University Strategic Objectives, SMU began the process of migrating to a “Zoned Network Architecture.” In 2007, SMU commenced a project to implement NAC for the Academic and Administrative buildings. October 30th, 2008 Southern Methodist University

4 Southern Methodist UniversityProcess Began with a definition of NAC Defined use cases, architecture preferences, required features, and goals Created a comprehensive questionnaire Compiled the questionnaires into a matrix Assembled a short list of vendors based on red-flags from matrix Scheduled on-line demos, then onsite visits, then finally in-house evaluations October 30th, 2008 Southern Methodist University

5 Southern Methodist UniversityOctober 30th, 2008 Southern Methodist University

6 Southern Methodist UniversityNAC Definition Network Access Control (NAC) is the system1 that ensures each person and device2 connecting3 to the university network4 is in compliance with the security requirements of the zone5 being entered or ascending to.  The NAC System, in concert with the university security zone architecture5, ensures appropriate accountability6 (authentication and authorization) for the individual connecting to the university network and appropriate levels of protection7 for all other users and assets already on the university network and the internet. System in this context is a set of process, procedures, software, hardware, policies and people assembled to deliver a cohesive service. Device in this context is any node on the university network that receives an IP address, both routable and un-routable. Connecting to the network in this context is the process of requesting an IP address. University network includes all university IP assets involved in the delivery of voice or data services. University IP assets includes all institutionally owned or managed hardware/software and IP address ranges with actual or implied association with the university. Please reference separate work-in-progress for definition of security zone and security zone architecture. Accountability in this context is for ones own actions while using an SMU provided IP address.  While SMU respects the privacy of each individual using the university network, use of the university network does not provide anonymity or separation from ones actions .  Activity or incidents that precipitate an investigation will be pursued to the full extent of university policy and rule of law. Protection in this context is protection from malware attack afforded by the security zone occupied. October 30th, 2008 Southern Methodist University

7 Southern Methodist UniversityUse Cases? October 30th, 2008 Southern Methodist University

8 Southern Methodist UniversityNAC Use Case Scenarios Faculty/Staff users in their office Faculty/Staff Wireless users Remote users on dial up or VPN Student Wireless users Student Wired users Student users without administrative privileges Student users with company owned laptops Public access users with no SMU credentials October 30th, 2008 Southern Methodist University

9 Southern Methodist UniversityRequirements October 30th, 2008 Southern Methodist University

10 Southern Methodist UniversityNAC Requirements Must be out-of-band Must be vendor neutral for network equipment Must integrate with the existing Wireless, VPN, and dial up infrastructure Must support Single Sign on Must support Windows XP and Vista, MAC OSX, and Linux Must have the ability to provide guest login Must provide interface for distributed administration Must provide historical information and search capabilities for connection tracking and forensic analysis Must provide policy enforcement for Antivirus, Anti-Spyware and Operating System patches October 30th, 2008 Southern Methodist University

11 Additional Important FeaturesIntegration with Wiring Database Ability to integrate with IDP/IPS/Packetshaper Ability to prevent illicit peer-to-peer usage Ability to search for historical MAC to IP address information Integration with Active Directory for Administrator login Provide separate help desk interface with reduced privileges Provide the ability to create an alarm based on failed policy checks or network policy violations Provide detailed reporting functions within the admin interface. Provide web portal customization within the interface. October 30th, 2008 Southern Methodist University

12 Southern Methodist UniversityLandscape October 30th, 2008 Southern Methodist University

13 Southern Methodist UniversityNAC Landscape ITS Reviewed the top 20 vendors in the NAC marketplace. Of these vendors, we received 18 responses. The vendors all apply different solutions for NAC. These approaches can be broken down into 7 general categories. Each vendor offers a combination of either agentless, dissolvable agent, and permanent agent solutions. These combinations are customizable based on our use case definitions. October 30th, 2008 Southern Methodist University

14 Southern Methodist UniversityArchitecture October 30th, 2008 Southern Methodist University

15 Southern Methodist UniversityNAC Approaches In-line Switch Replacement Uplink Aggregation Out of Band SNMP Device Management Permanent Agent Traffic Monitoring 802.1x/Radius Device Management ARP (Address Resolution Protocol) Agent October 30th, 2008 Southern Methodist University

16 Inline – Switch ReplacementOctober 30th, 2008 Southern Methodist University

17 Inline – Switch ReplacementPro Provides the most granular coverage of any NAC solution. Agentless solution. Con Requires all switches to be replaced with NAC switches. October 30th, 2008 Southern Methodist University

18 Inline – Uplink AggregationOctober 30th, 2008 Southern Methodist University

19 Inline – Uplink AggregationPro Agentless solution. Con Creates a bottleneck which all traffic must flow through. October 30th, 2008 Southern Methodist University

20 Out-of-Band – SNMP ManagementOctober 30th, 2008 Southern Methodist University

21 Out-of-Band – SNMP ManagementPro Can make VLAN changes, ensuring that users are moved to the appropriate security zone. Con SNMP packets may be dropped, consequently updates to VLANs can be delayed. Changes made via SNMP are not logged in the switch event log or in the switch log, which can make accounting for changes a challenge. October 30th, 2008 Southern Methodist University

22 Out-of-Band – Permanent AgentOctober 30th, 2008 Southern Methodist University

23 Out-of-Band – Permanent AgentPro Can be integrated with existing Antivirus agent. Con Does not offer the ability to change VLANS. Not a good fit for unmanaged devices. October 30th, 2008 Southern Methodist University

24 Out-of-Band – Traffic MonitoringOctober 30th, 2008 Southern Methodist University

25 Out-of-Band – Traffic MonitoringPro Obtains traffic information similar to an IDS, which offers the ability to act on signatures. Con Potential loss of traffic on mirror port. Complicates router configuration. October 30th, 2008 Southern Methodist University

26 Out-of-Band – 802.1x/Radius Device ManagementOctober 30th, 2008 Southern Methodist University

27 Pro Con Out-of-Band – 802.1x/Radius Device ManagementIntegrates with 802.1x capable devices Con Requires agent to be installed on Radius or Active Directory servers. October 30th, 2008 Southern Methodist University

28 Out-of-Band – ARP AgentOctober 30th, 2008 Southern Methodist University

29 Out-of-Band – ARP AgentPro Doesn’t require integration or replacement of existing switches. Con Manipulates ARP (Address Resolution Protocol) tables on each client, which may be viewed as being invasive. Requires at least 1 agent on each VLAN to enforce policy. October 30th, 2008 Southern Methodist University

30 Southern Methodist UniversityQuestions? George Finney Phone: October 30th, 2008 Southern Methodist University