Network-discovery device paved the way for a rollout at Reed Smith
Pittsburgh-based law firm Reed Smith was getting ready to deploy Enterasys Networks’ NAC gear but had to first enlist another vendor to find and map all the devices on its network.
The firm could have done the inventory by hand, but that would have cost more, and the results would have been less current than those generated by a network-discovery device from Great Bay Software, says Frank Hervert, senior manager of network access services for Reed Smith.
The Enterasys NAC architecture calls for using 802.1X port authentication to determine whether to let devices onto the network, but other network devices that don’t support 802.1X — such as printers, VoIP phones, heating/ventilation systems and key-card readers — needed admission policies as well, he says.
Once admission policies are loaded on the Enterasys switches, the Great Bay appliances can invoke them for all non-802.1X devices, according to Hervert.
The first step, though, was to confirm every device on the network. With 13,000 devices, Hervert calculates that two full-time administrators would need 650 hours each to perform the task of verifying every device in 21 offices located in the United States and Europe.
Their salaries for that period would be more than double the roughly $40,000 Reed Smith paid for two Great Bay boxes, including support and maintenance, Hervert says. Plus the manual inventory would have been out of date before it was completed because of subsequent network changes.
So the firm bought two Beacon Endpoint Profiler appliances from Great Bay Software that discover and profile all endpoints on the network and continue monitoring to make sure they remain complaint with admission policies, he says. The gear also maps the network.
The Profiler appliances discover how each device is attached to the network, including which port on which switch or router. They also discover how a device is using the network, as in the case of a desktop, or how it serves the network, as in the case of a printer. Profiler also tracks over time the behavior of a device. “We needed to know what devices would not authenticate [via 802.1X], and staggeringly it was 60% of our environment,” Hervert says.
Hervert says he wanted to easily create a way for non-802.1X devices to authenticate to the network and have an access policy applied so malicious users could not log in from a PC as a printer and gain network access.
With Profiler, he can dictate a single 802.1X policy for all printers, for example, and the switches will enforce it. So printers can gain network access, but that access is restricted to only TCP port 9100 needed for printing. “You can pretty much deny everything else to that switch port,” says Tim O’Donnell, a network analyst for Reed Smith. “You can deny it the capability to browse the Web or act as a DHCP server.”
Similarly, the device can restrict the access of servers to just the ports they need to transact with desktops.
The device has other utilities, such as the ability to track devices when they move from switch to switch. For example, a laptop suspected of being used for recreational activities was tracked from the firm’s Washington, D.C., office to another office by means of its MAC and IP addresses. Profiler kept a record of which switch ports the device attached to, and that information led to finding the offending device and user, Hervert says.
While the Profilers have that type of security benefit, that was not their primary worth, he says. “Beacon wasn’t driven to identify security issues,” Hervert says. “Beacon was driven to help us discover where we had to apply specific policies to devices we didn’t know about.”
