[26190] in resnet
Re: Switching from Cisco NAC to Impulse Safe Connect
daemon@ATHENA.MIT.EDU (Peter P Morrissey)
Thu Apr 7 10:55:33 2011
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_AC68B492989C7B4CB1F58A95F2B3F1E004DDD2AE5Dsuex07mbx03ad_"
MIME-Version: 1.0
Message-ID: <AC68B492989C7B4CB1F58A95F2B3F1E004DDD2AE5D@suex07-mbx-03.ad.syr.edu>
Date: Thu, 7 Apr 2011 10:52:47 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Peter P Morrissey <ppmorris@syr.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <BANLkTi=DOsN3-CBASMr7fVMgT1rCKEJygw@mail.gmail.com>
--_000_AC68B492989C7B4CB1F58A95F2B3F1E004DDD2AE5Dsuex07mbx03ad_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
We switched from a home grown system to Safeconnect. We looked very closely=
at the Cisco products as well as Bradford.
We weren't comfortable with dynamic VLAN steering, and some of our switches=
weren't capable of it. We also did not want the expense and risks of an in=
line approach.
1. What were the major hurdles (if any)?
The biggest obstacle that we didn't plan for was configuring all the web pa=
ges for the different conditions. They have a tool, and there is lots of fl=
exibility, but it is a time consuming process. I would put aside a week for=
the configuration and testing. That was really time intensive part that I =
remember aside from some of the design and planning etc which really wasn't=
that bad.
2. Does the product work as advertised?
Yes, with some caveats.
3. Has the end-user experience improved (quicker logins and fewer login iss=
ues)?
There are two aspects to the end-user experience. One is when they first co=
me on the network and have to have the posture of their machine checked, as=
well as configure for 802.1x. This was greatly improved over our other sys=
tem. We require resident students to have AV running, Windows Update turned=
on and the Windows firewall turned on. We had very few incidents with the =
8,000 residents who we had to get on the network for the past two Fall open=
ings which made us look good. We have found the AV support to be very good.=
Just about any product that is legitimate seems to be supported. And, when=
we have come across versions or products that we wanted supported, they ha=
ve been very responsive about fingerprinting them. They also seem to be abl=
e to identify games well, and various other crazy devices like Tivos etc th=
at people plug into the network. These are automatically let on the network=
as they can't install agents. We don't have to set up exceptions for them.=
They recently added a feature that also identifies mobile devices and give=
s them a pass. In addition, the ability to set up custom policies by AD gro=
up is very powerful. We use xpressconnect to deal with 802.1x configs and t=
hey work very well together.
The login issues are another matter. We set ours up so that 802.1x automati=
cally authenticates them via a radius back end so that users don't have to =
log in manually every time they connect. We get complaints about people get=
ting login pages for no apparent reason, but even more complaints of people=
getting the safeconnect install page frequently for no apparent reason. I =
can't tell you how many times I've been in meetings that have included stud=
ents and they ask me why this keeps happening. It has been an issue for a l=
ong time. Some of them have been explainable. For example, if the machine d=
oes get hosed with malware, it slows down the agent registering when it com=
es on the network. Thing is most of the complaints are from Mac users who d=
on't tend to have many malware issues. We may be more anal about the end us=
er experience than other schools though as it sounds like other schools eit=
her don't have the problem, don't notice, or just aren't bothered by it. We=
try to keep the end user experience as seamless and predictable as we poss=
ibly can.
4. Is administration easier?
I would say it is generally easier than our previous system, but I can't co=
mpare that to Cisco. I would say that I like their dashboard which is used =
to search for and report upon users based upon MAC address, IP address or U=
ser ID, or OS. We have leveraged this for other things as well such as for =
finding rogue access points or using it in conjunction with our Cisco WCS t=
o find stolen laptops. There is a client based admin GUI as well for settin=
g up the web pages and policies etc. We were also frustrated by the fact th=
at there are a lot of things we can't see and control. However, their model=
is more of an outsourced model. This has been hard for us to adjust to aft=
er doing it ourselves. I can understand why they want to protect the system=
from being messed with. The other good thing is that they are willing to d=
eal directly with our first line help desk, and even end users when trouble=
shooting a problem. And, we have had our share of bugs, outages and unexpla=
ined problems. Fortunately none of those ever occurred during opening when =
we are trying to impress the parents spending the big bucks. :) And regardi=
ng that, they do understand the unique needs of the education space which i=
sn't true for all vendors. During opening they are staffed up and available=
in case there are problems. They also time upgrades to do over the summer =
or over the Christmas break. They have improved in their QA, but I think th=
ere is still more room for improvement there.
5. How long did it take to complete implementation?
We've had the system a number of years now and from what I remember it real=
ly wasn't bad. We found them generally very easy to work with. Another thin=
g to keep in mind is that it relies upon the router to do the initial captu=
re, and also quarantines for devices that don't have agents. We have had is=
sues with "perfect storms" of SNMP processes and Safeconnect maxing out the=
CPU and that is a risk of this approach that you should be aware of. In ge=
nerally they work very hard to control this. An advantage of doing the cont=
rol at the router (or routers in our case) is that there are less network d=
evices that have to be managed. When someone first connects it can take a c=
ouple of minutes to "capture" them. During that time they have free access =
to the network, so it is theoretically possible to infect other machines wi=
th a network base virus during that time. This has never been a problem for=
us. One reason may be that all the other machines have windows update, fir=
ewalls and AV turned on.
Peter M.
From: Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] On Behalf Of Joe Hatch
Sent: Wednesday, April 06, 2011 11:55 AM
To: RESNET-L@LISTSERV.ND.EDU
Subject: Switching from Cisco NAC to Impulse Safe Connect
We're strongly considering switching from Cisco NAC to Safe Connect and wou=
ld welcome comments from those who have experienced the transition.
1. What were the major hurdles (if any)?
2. Does the product work as advertised?
3. Has the end-user experience improved (quicker logins and fewer login iss=
ues)?
4. Is administration easier?
5. How long did it take to complete implementation?
Thanks,
Joseph Hatch
Information Technology Services
Trinity University
(210) 999-7826
___________________________________________________ You are subscribed to t=
he ResNet-L mailing list.
To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.=
EDU/archives/resnet-l.html ________________________________________________=
___
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--_000_AC68B492989C7B4CB1F58A95F2B3F1E004DDD2AE5Dsuex07mbx03ad_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:p=3D"urn:schemas-m=
icrosoft-com:office:powerpoint" xmlns:a=3D"urn:schemas-microsoft-com:office=
:access" xmlns:dt=3D"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s=3D"=
uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs=3D"urn:schemas-microsof=
t-com:rowset" xmlns:z=3D"#RowsetSchema" xmlns:b=3D"urn:schemas-microsoft-co=
m:office:publisher" xmlns:ss=3D"urn:schemas-microsoft-com:office:spreadshee=
t" xmlns:c=3D"urn:schemas-microsoft-com:office:component:spreadsheet" xmlns=
:odc=3D"urn:schemas-microsoft-com:office:odc" xmlns:oa=3D"urn:schemas-micro=
soft-com:office:activation" xmlns:html=3D"http://www.w3.org/TR/REC-html40" =
xmlns:q=3D"http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc=3D"http://m=
icrosoft.com/officenet/conferencing" xmlns:D=3D"DAV:" xmlns:Repl=3D"http://=
schemas.microsoft.com/repl/" xmlns:mt=3D"http://schemas.microsoft.com/share=
point/soap/meetings/" xmlns:x2=3D"http://schemas.microsoft.com/office/excel=
/2003/xml" xmlns:ppda=3D"http://www.passport.com/NameSpace.xsd" xmlns:ois=
=3D"http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir=3D"http://=
schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds=3D"http://www.w3=
.org/2000/09/xmldsig#" xmlns:dsp=3D"http://schemas.microsoft.com/sharepoint=
/dsp" xmlns:udc=3D"http://schemas.microsoft.com/data/udc" xmlns:xsd=3D"http=
://www.w3.org/2001/XMLSchema" xmlns:sub=3D"http://schemas.microsoft.com/sha=
repoint/soap/2002/1/alerts/" xmlns:ec=3D"http://www.w3.org/2001/04/xmlenc#"=
xmlns:sp=3D"http://schemas.microsoft.com/sharepoint/" xmlns:sps=3D"http://=
schemas.microsoft.com/sharepoint/soap/" xmlns:xsi=3D"http://www.w3.org/2001=
/XMLSchema-instance" xmlns:udcs=3D"http://schemas.microsoft.com/data/udc/so=
ap" xmlns:udcxf=3D"http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udc=
p2p=3D"http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf=3D"http:/=
/schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss=3D"http://sche=
mas.microsoft.com/office/2006/digsig-setup" xmlns:dssi=3D"http://schemas.mi=
crosoft.com/office/2006/digsig" xmlns:mdssi=3D"http://schemas.openxmlformat=
s.org/package/2006/digital-signature" xmlns:mver=3D"http://schemas.openxmlf=
ormats.org/markup-compatibility/2006" xmlns:m=3D"http://schemas.microsoft.c=
om/office/2004/12/omml" xmlns:mrels=3D"http://schemas.openxmlformats.org/pa=
ckage/2006/relationships" xmlns:spwp=3D"http://microsoft.com/sharepoint/web=
partpages" xmlns:ex12t=3D"http://schemas.microsoft.com/exchange/services/20=
06/types" xmlns:ex12m=3D"http://schemas.microsoft.com/exchange/services/200=
6/messages" xmlns:pptsl=3D"http://schemas.microsoft.com/sharepoint/soap/Sli=
deLibrary/" xmlns:spsl=3D"http://microsoft.com/webservices/SharePointPortal=
Server/PublishedLinksService" xmlns:Z=3D"urn:schemas-microsoft-com:" xmlns:=
st=3D"" xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta http-equi=
v=3DContent-Type content=3D"text/html; charset=3Dus-ascii"><meta name=3DGen=
erator content=3D"Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue vli=
nk=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span style=3D'f=
ont-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>We switch=
ed from a home grown system to Safeconnect. We looked very closely at the C=
isco products as well as Bradford.<o:p></o:p></span></p><p class=3DMsoNorma=
l><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:=
#1F497D'>We weren’t comfortable with dynamic VLAN steering, and some =
of our switches weren’t capable of it. We also did not want the expen=
se and risks of an inline approach.<o:p></o:p></span></p><p class=3DMsoNorm=
al><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color=
:#1F497D'><o:p> </o:p></span></p><p class=3DMsoNormal>1. What were the=
major hurdles (if any)?<o:p></o:p></p><p class=3DMsoNormal><span style=3D'=
font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>The bigg=
est obstacle that we didn’t plan for was configuring all the web page=
s for the different conditions. They have a tool, and there is lots of flex=
ibility, but it is a time consuming process. I would put aside a week for t=
he configuration and testing. That was really time intensive part that I re=
member aside from some of the design and planning etc which really wasnR=
17;t that bad. <o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'fo=
nt-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> =
;</o:p></span></p><p class=3DMsoNormal>2. Does the product work as advertis=
ed?<o:p></o:p></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font=
-family:"Calibri","sans-serif";color:#1F497D'>Yes, with some caveats.<o:p><=
/o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-f=
amily:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p =
class=3DMsoNormal>3. Has the end-user experience improved (quicker logins a=
nd fewer login issues)?<o:p></o:p></p><p class=3DMsoNormal><span style=3D'f=
ont-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>There are=
two aspects to the end-user experience. One is when they first come on the=
network and have to have the posture of their machine checked, as well as =
configure for 802.1x. This was greatly improved over our other system. We r=
equire resident students to have AV running, Windows Update turned on and t=
he Windows firewall turned on. We had very few incidents with the 8,000 res=
idents who we had to get on the network for the past two Fall openings whic=
h made us look good. We have found the AV support to be very good. Just abo=
ut any product that is legitimate seems to be supported. And, when we have =
come across versions or products that we wanted supported, they have been v=
ery responsive about fingerprinting them. They also seem to be able to iden=
tify games well, and various other crazy devices like Tivos etc that people=
plug into the network. These are automatically let on the network as they =
can’t install agents. We don’t have to set up exceptions for th=
em. They recently added a feature that also identifies mobile devices and g=
ives them a pass. In addition, the ability to set up custom policies by AD =
group is very powerful. We use xpressconnect to deal with 802.1x configs an=
d they work very well together.<o:p></o:p></span></p><p class=3DMsoNormal><=
span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F=
497D'>The login issues are another matter. We set ours up so that 802.1x au=
tomatically authenticates them via a radius back end so that users don̵=
7;t have to log in manually every time they connect. We get complaints abou=
t people getting login pages for no apparent reason, but even more complain=
ts of people getting the safeconnect install page frequently for no apparen=
t reason. I can’t tell you how many times I’ve been in meetings=
that have included students and they ask me why this keeps happening. It h=
as been an issue for a long time. Some of them have been explainable. For e=
xample, if the machine does get hosed with malware, it slows down the agent=
registering when it comes on the network. Thing is most of the complaints =
are from Mac users who don’t tend to have many malware issues. We may=
be more anal about the end user experience than other schools though as it=
sounds like other schools either don’t have the problem, don’t=
notice, or just aren’t bothered by it. We try to keep the end user e=
xperience as seamless and predictable as we possibly can. <o:p></o:p></span=
></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Cali=
bri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=3DMso=
Normal>4. Is administration easier?<o:p></o:p></p><p class=3DMsoNormal><spa=
n style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>I would say it is generally easier than our previous system, but I can&#=
8217;t compare that to Cisco. I would say that I like their dashboard which=
is used to search for and report upon users based upon MAC address, IP add=
ress or User ID, or OS. We have leveraged this for other things as well suc=
h as for finding rogue access points or using it in conjunction with our Ci=
sco WCS to find stolen laptops. There is a client based admin GUI as well f=
or setting up the web pages and policies etc. We were also frustrated by th=
e fact that there are a lot of things we can’t see and control. Howev=
er, their model is more of an outsourced model. This has been hard for us t=
o adjust to after doing it ourselves. I can understand why they want to pro=
tect the system from being messed with. The other good thing is that they a=
re willing to deal directly with our first line help desk, and even end use=
rs when troubleshooting a problem. And, we have had our share of bugs, outa=
ges and unexplained problems. Fortunately none of those ever occurred durin=
g opening when we are trying to impress the parents spending the big bucks.=
</span><span style=3D'font-size:11.0pt;font-family:Wingdings;color:#1F497D=
'>J</span><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif=
";color:#1F497D'> And regarding that, they do understand the unique needs o=
f the education space which isn’t true for all vendors. During openin=
g they are staffed up and available in case there are problems. They also t=
ime upgrades to do over the summer or over the Christmas break. They have i=
mproved in their QA, but I think there is still more room for improvement t=
here.<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:11=
.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></s=
pan></p><p class=3DMsoNormal>5. How long did it take to complete imple=
mentation?<o:p></o:p></p><p class=3DMsoNormal><span style=3D'font-size:11.0=
pt;font-family:"Calibri","sans-serif";color:#1F497D'>We’ve had the sy=
stem a number of years now and from what I remember it really wasn’t =
bad. We found them generally very easy to work with. Another thing to keep =
in mind is that it relies upon the router to do the initial capture, and al=
so quarantines for devices that don’t have agents. We have had issues=
with “perfect storms” of SNMP processes and Safeconnect maxing=
out the CPU and that is a risk of this approach that you should be aware o=
f. In generally they work very hard to control this. An advantage of doing =
the control at the router (or routers in our case) is that there are less n=
etwork devices that have to be managed. When someone first connects it can =
take a couple of minutes to “capture” them. During that time th=
ey have free access to the network, so it is theoretically possible to infe=
ct other machines with a network base virus during that time. This has neve=
r been a problem for us. One reason may be that all the other machines have=
windows update, firewalls and AV turned on.<o:p></o:p></span></p><p class=
=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-se=
rif";color:#1F497D'><o:p> </o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'=
>Peter M.<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-siz=
e:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p=
></span></p><div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;paddin=
g:3.0pt 0in 0in 0in'><p class=3DMsoNormal><b><span style=3D'font-size:10.0p=
t;font-family:"Tahoma","sans-serif"'>From:</span></b><span style=3D'font-si=
ze:10.0pt;font-family:"Tahoma","sans-serif"'> Resnet Forum [mailto:RESNET-L=
@LISTSERV.ND.EDU] <b>On Behalf Of </b>Joe Hatch<br><b>Sent:</b> Wednesday, =
April 06, 2011 11:55 AM<br><b>To:</b> RESNET-L@LISTSERV.ND.EDU<br><b>Subjec=
t:</b> Switching from Cisco NAC to Impulse Safe Connect<o:p></o:p></span></=
p></div><p class=3DMsoNormal><o:p> </o:p></p><div><p class=3DMsoNormal=
>We're strongly considering switching from Cisco NAC to Safe Connect and wo=
uld welcome comments from those who have experienced the transition.<o:p></=
o:p></p></div><div><p class=3DMsoNormal> <o:p></o:p></p></div><div><p =
class=3DMsoNormal>1. What were the major hurdles (if any)?<o:p></o:p></p></=
div><div><p class=3DMsoNormal>2. Does the product work as advertised?<o:p><=
/o:p></p></div><div><p class=3DMsoNormal>3. Has the end-user experience imp=
roved (quicker logins and fewer login issues)?<o:p></o:p></p></div><div><p =
class=3DMsoNormal>4. Is administration easier?<o:p></o:p></p></div><div><p =
class=3DMsoNormal>5. How long did it take to complete implementation?<=
o:p></o:p></p></div><div><p class=3DMsoNormal> <o:p></o:p></p></div><d=
iv><p class=3DMsoNormal> <o:p></o:p></p></div><div><p class=3DMsoNorma=
l> <o:p></o:p></p></div><div><p class=3DMsoNormal>Thanks,<o:p></o:p></=
p></div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><br clear=
=3Dall>Joseph Hatch<br>Information Technology Services<br>Trinity Universit=
y<br>(210) 999-7826<br><br><br><o:p></o:p></p></div><p class=3DMsoNormal>__=
_________________________________________________ You are subscribed to the=
ResNet-L mailing list. <o:p></o:p></p><p>To subscribe, unsubscribe or sear=
ch the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html ______=
_____________________________________________ <o:p></o:p></p></div></body><=
/html>=
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--_000_AC68B492989C7B4CB1F58A95F2B3F1E004DDD2AE5Dsuex07mbx03ad_--
