Enterasys Networks 9034385 - Manual (Page 47)

Scenario 3: Non-intelligent Access Edge (Wired and Wireless)
Enterasys NAC Design Guide 3-9
It is important to note that if the wireless edge of the network is non‐intelligent and not capable of
authenticating and authorizing wireless end‐systems, it is possible to augment the network
topology to implement out‐of‐band NAC with the NAC Gateway. This can be accomplished
without replacing the physical edge of the network, by adding an intelligent edge switch that
possesses specialized authentication and authorization features.
The Enterasys Matrix N‐series switch is capable of authenticating and authorizing numerous end‐
systems connected on a single port through Multi‐User Authentication (MUA), and may be
positioned upstream from non‐intelligent third‐party wireless APs to act as the intelligent edge on
the network. The Enterasys Matrix N‐series switch is capable of authenticating and authorizing
over 1000 end‐systems uplinked to a single Matrix N‐series port from an AP, a set of APs, or
wireless switches. In this configuration, the Matrix N‐series acts as the intelligent edge switch on
the network, although not physically located on the access edge. By provisioning access to
network resources on the Matrix N‐series via MUA, end‐system traffic destined to adjacent
switches on the network can be securely contained at the Matrix N‐series port.
Scenario 3: Non-intelligent Access Edge (Wired and Wireless)
In the non‐intelligent access edge use scenario, the edge switches and access points that compose
the network access layer are not capable of authenticating and authorizing the connecting end‐
systems on the network.
In this scenario, inline NAC is implemented by positioning the NAC Controller at a strategic point
in the network topology, as the authorization point for end‐system traffic enforcement.
The NAC Controller may be positioned directly within the VLAN where end‐systems are
connected or across one or more routed boundaries. When the NAC Controller is positioned
within the VLAN where end‐systems are connected, each device is uniquely identified by its
associated MAC address. When the NAC Controller is positioned across a routed boundary (for
example, behind a WAN router located in an enterpriseʹs central site), each end‐system is
identified by its associated IP address.
The following figure illustrates how the NAC Controller and the other Enterasys NAC
components work together in the non‐intelligent edge to provide network access control.