General

Bolting the Back Door with NAC
Part 4: Deploying the Juniper Networks UAC 2.0
— continued

by Lisa Phifer VP Core Competence, Inc. [June 25, 2007]

Charting a course
Given the use cases outlined in part 2 and the TNC components described on the previous page, we were ready to move from abstract to concrete. Next, we had to decide how users would be authenticated, what measurements would be validated, how those results would map into roles, and how those roles would limit network resource access. The target policies we decided to implement are summarized below:

The IC4000's RADIUS server can consult many third-party directories, including LDAP, RSA, NIS, and Netegrity. We wanted to tap our Windows AD to authenticate our own staff, using group membership to determine role. We also planned to create a customer user list on the IC4000, mapping each to a separate role. Finally, we intended to use the IC4000's web portal to admit anonymous guests.

UAC can use TNC APIs to communicate with third-party Integrity Measurement Collectors and Verifiers. For simplicity, we decided to use only rules that Juniper's Host Checker could verify without third-party software. The IC offers a long list of predefined rules for Windows endpoints—we combined a few of those with a custom registry rule and a MAC address bypass rule. The latter gets known/trusted devices past rules that cannot otherwise be enforced (here, a laptop with unrecognized beta AV). Juniper does not currently offer predefined rules for Linux or Mac, but custom rules can check for known processes, ports, or files on those endpoints.

Note that rules cannot even be evaluated on OSs that cannot run Host Checker. This is why we ended up giving non-compliant guests limited internet access instead of blocking them altogether—we needed to admit our un-checkable WinMobile devices. The right way to handle atypical devices like PDAs, VoIP phones, and scanners depends on your own business needs and threat tolerance. We included this simple example in our test to show why it is import to identify and resolve such exceptions during policy design.

 

Page one: Assembling the pieces

Page two: Charting a course

>Page three: Building a foundation

Page four: Users, endpoints, and roles

Page five: Resource access and policy enforcement

Page six: Conclusion