Document Outline

• NAC Design Guide
• Notice
• Contents
• About This Guide
  • Intended Audience
  • Related Documents
  • Getting Help
• Overview
  • NAC Solution Overview
    • Key Functionality
    • Deployment Models
  • NAC Solution Components
    • The NAC Appliance
      • NAC Gateway Appliance
      • NAC Controller Appliance
      • Appliance Comparison
    • NetSight Management
      • NetSight NAC Manager
      • NetSight Console
      • NetSight Policy Manager
      • NetSight Inventory Manager
    • RADIUS Server
    • Assessment Server
  • Summary
• NAC Deployment Models
  • Model 1: End-System Detection and Tracking
    • Implementation
      • Out-of-Band NAC
      • Inline NAC (Layer 2)
      • Inline NAC (Layer 3)
    • Features and Value
    • Required and Optional Components
  • Model 2: End-System Authorization
    • Implementation
      • Out-of-Band NAC
      • Inline NAC
    • Features and Value
    • Required and Optional Components
  • Model 3: End-System Authorization with Assessment
    • Implementation
      • Out-of-Band NAC
      • Inline NAC
    • Features and Value
    • Required and Optional Components
  • Model 4: End-System Authorization with Assessment and Remediation
    • Implementation
      • Out-of-Band NAC
      • Inline NAC
    • Features and Value
    • Required and Optional Components
  • Summary
• Use Scenarios
  • Scenario 1: Intelligent Wired Access Edge
    • Policy-Enabled Edge
    • RFC 3580 Capable Edge
    • Scenario 1 Implementation
  • Scenario 2: Intelligent Wireless Access Edge
    • Thin Wireless Edge
    • Thick Wireless Edge
    • Scenario 2 Implementation
  • Scenario 3: Non-intelligent Access Edge (Wired and Wireless)
    • Scenario 3 Implementation
  • Scenario 4: VPN Remote Access
    • Scenario 4 Implementation
  • Summary
• Design Planning
  • Identify the NAC Deployment Model
  • Survey the Network
    • 1. Identify the Intelligent Edge of the Network
    • 2. Evaluate Policy/VLAN and Authentication Configuration
      • Case #1: No authentication method is deployed on the network.
      • Case #2: Authentication methods are deployed on the network.
    • 3. Identify the Strategic Point for End-System Authorization
    • 4. Identify Network Connection Methods
      • Wired LAN
      • Wireless LAN
      • Remote Access WAN
      • Site-to-Site VPN
      • Remote Access VPN
  • Identify Inline or Out-of-band NAC Deployment
  • Summary
• Design Procedures
  • Procedures for Out-of-Band and Inline NAC
    • 1. Identify Required NetSight Applications
    • 2. Define Network Security Domains
      • NAC Configurations
    • 3. Identify Required MAC and User Overrides
      • MAC Overrides
      • User Overrides
  • Assessment Design Procedures
    • 1. Determine the Number of Assessment Servers
    • 2. Determine Assessment Server Location
    • 3. Identify Assessment Server Configuration
  • Out-of-Band NAC Design Procedures
    • 1. Identify Network Authentication Configuration
    • 2. Determine the Number of NAC Gateways
    • 3. Determine NAC Gateway Location
    • 4. Identify Backend RADIUS Server Interaction
    • 5. Determine End-System Mobility Restrictions
    • 6. VLAN Configuration
    • 7. Policy Role Configuration
    • 8. Define NAC Access Policies
      • Failsafe Policy and Accept Policy Configuration
      • Assessment Policy and Quarantine Policy Configuration
      • Unregistered Policy
  • Inline NAC Design Procedures
    • 1. Determine NAC Controller Location
    • 2. Determine the Number of NAC Controllers
    • 3. Identify Backend RADIUS Server Interaction
    • 4. Define Policy Configuration
      • Failsafe Policy and Accept Policy Configuration
      • Assessment Policy and Quarantine Policy Configuration
      • Unregistered Policy
  • Additional Considerations
    • NAC Deployment With an Intrusion Detection System (IDS)
    • NAC Deployment With NetSight ASM