As many of you know, the answers to our monthly Author Expert book giveaway competition can be found in the pages of NetworkWorld.com. In April’s competition, I asked:
There are three fundamental approaches to NAC based on where the access control is being enforced in the enterprise – what are they?
I was expecting the answer edge control, core control and client control, as cited in “The NAC labryrinth” an article that’s part of the NAC Cram Session. But I also received entries with this answer: 802.1x, DHCP, and compartmentalization. Not being an expert in NAC, I turned to Mark Kadrich, author of Endpoint Security, the book that was up for grabs, for his wisdom as to whether the second answer was also correct. He provided this thorough explanation, which gave me confidence to also include entries with that answer in the drawer – check out the winning entries here. I wanted to share his answer with you.
Mark wrote:
Yes, these are valid answers to the question. It just depends on if you’re talking about the type of enforcement (edge/core/client) or the type of technology used (802.1x/DHCP/custom).
When you’re enforcing at the core, you’re allowing packets to enter the network and dropping packets at the core. This means that all the networks between the endpoint and the core could be attacked depending on architecture. You can use routing protocols and filters to accomplish enforcement. Yes, there’s a bunch of policy stuff wrapped into it as well. At the edge, you use the switch to either not provide access or to vlan you to a remediation network or the Internet. So, how would you make this work? Well, 802.1x is an authentication based protocol that allows the network to decide if the user meets the authentication requirements. This is also where some vendors are attaching their agent because it’s an open standard. This would also be an example of edge-based NAC. Oh, you can also use DHCP for this.
DHCP is a form of compartmentalization/core enforcement because it’s relying on the IP address to place you in some bucket (VLAN/segment/compartment) on the network. Some might argue that it’s an edge-based protocol but any way you slice it you’re depending on voluntary participation. If the decision is based on the IP addresss, changing the IP address will render DHCP enforcement less than effective. I call it voluntary participation. (Yes officer, I promisenot to speed ever again…zoom)
At the client, it’s pretty much self enforcement where a widget loaded on the client prevents access. Having said that, there are clients that will talk to a gateway (the old Sygate stuff did this pretty well) which is a bump in the wire. If the client can’t authenticate, remediate, or pass trust tests, the packets are dropped at the security gateway. Make note that you still have access to the other networks within that network compartment.
Now, this is really where the marketing folks have done a great job of mucking things up. As you can see, the 802.1x enforcement happens at the edge but the decision is made in the core infrastructure at a policy server. The implementation just happens at the edge. Same with the client stuff. It’s happening at the endpoint which, I might point out, is really the true edge or perimeter. But now we’ve gotten into a religious war that says the network and the endpoint must remain apart and separate because many people’s jobs depend on that separation. I like to call those people morons. If they’re really rabid about it, I like to call them shortsighted morons.
