ConSentry LANShield

Cost: $13,995 for LANShield switch; $2,995 for 100 agents; $7,995 for Insight Manager.

Score: 3.93

ConSentry integrates standard functionality for network-access control directly into a switch device it calls LANShield — which then replaces your existing access switches. The LANShield switch and all role- and policy-management capabilities are managed by ConSentry InSight, a standalone Windows-based management application while endpoint assessment is carried out by an agent ConSentry licenses from Check Point.

ConSentry also offers a second NAC option called the LANShield Controller, which we tested late last year. The Controller sits a little farther into the network, such as between the access and distribution layers, and controls NAC policy enforcement from there.

For this round of testing, we evaluated the LANShield switch, the product ConSentry submitted for this review, deployed it in-line as our access-layer switch in the test network. We did not employ ConSentry’s optional 802.1X support for this test, but that is certainly another deployment option.

Overall, ConSentry is focused on evaluating rights and providing secure access based on user profiles and the applications/resources a user wants to access. NAC policies are assigned to users’ roles, which are defined based on a number of factors, such as Active Directory group membership, MAC address and IP address. Authentication is handled by passively monitoring Windows-authentication traffic or actively support for RADIUS back ends.

ConSentry also supports guest users via a captive portal. The passive Windows-authentication feature is an interesting one that is also used by ForeScout in its product. However, there is a potential weakness here should a flood of network traffic cause an important packet to be lost. We did not conduct any load testing that would render a definitive answer to that question. The ConSentry folks say that their product is not susceptible to this issue, because it is designed on custom silicon to support 10Gbps, unlike PC-based products that support 1-2Gbps.

ConSentry licenses the Check Point Integrity dissolvable agent for end point assessment purposes that gets pushed out to the endpoint each time it attempts network connection. With this agent, AV checks for the major vendors are supported as well as custom checks for file information or registry keys. We created a custom registry and file check with the remediation action defined so that the LANShield would send a link to administrator-provided information should any end point be out of compliance. The detection, enforcement and remediation measures for this custom check all worked as expected.