Enterasys upgrades NAC app to work well with others

Clarifying issues surrounding this emerging security architecture

Enterasys is upgrading the software on its Sentinel NAC appliance so it can be dropped into any network with managed switches, not just Enterasys networks.

Before, the device could enforce NAC policies via Enterasys switches only, but with the upgrade the device can use two different standards-based methods for enforcing policies through switches made by other vendors.

The Sentinel appliance can send SNMP commands to switches to shut off switch ports being used by devices that fail to comply with mandated security postures set up by network administrators. The appliance can also use the 802.1Q VLAN standard to allow access for a non-compliant device, but only to a quarantine VLAN.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Enterasys is upgrading the software on its Sentinel NAC appliance so it can be dropped into any network with managed switches, not just Enterasys networks.

Before, the device could enforce NAC policies via Enterasys switches only, but with the upgrade the device can use two different standards-based methods for enforcing policies through switches made by other vendors.

The Sentinel appliance can send SNMP commands to switches to shut off switch ports being used by devices that fail to comply with mandated security postures set up by network administrators. The appliance can also use the 802.1Q VLAN standard to allow access for a non-compliant device, but only to a quarantine VLAN.

With the same upgrade, Enterasys is integrating Sentinel with its Dragon intrusion prevention gear. The combination provides pre-admission NAC and post-admission NAC. The former keeps devices that lack the appropriate security posture off the network. The latter drops access for devices that had been admitted but whose behavior on the network indicates it may pose a threat.

The combination of technologies fills significant gaps. With just pre-admission checking, NAC can tell whether a device has certain security features active and updated, but not whether the device is actually infected with something that could be dangerous to the network. It decreases the likelihood that it is infected, but doesn’t guarantee it.

Post-admission monitoring looks for signatures of known malware on the network as well as behavior by devices that may indicate they are behaving insecurely.

Customers who never would have considered Enterasys for NAC because they don’t use Enterasys switches now have it as an option.

Read more about security in Network World's Security section.

Tim Greene is senior editor at Network World.