[26192] in resnet
Re: Switching from Cisco NAC to Impulse Safe Connect
daemon@ATHENA.MIT.EDU (Cal Frye)
Thu Apr 7 11:24:03 2011
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Message-ID: <4D9DD6EF.7020002@calfrye.com>
Date: Thu, 7 Apr 2011 11:23:27 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Cal Frye <cjf@calfrye.com>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <AC68B492989C7B4CB1F58A95F2B3F1E004DDD2AE5D@suex07-mbx-03.ad.syr.edu>
We've had SafeConnect for two years.
On 4/7/11 10:52 AM, Peter P Morrissey wrote:
> We get complaints
> about people getting login pages for no apparent reason, but even more
> complaints of people getting the safeconnect install page frequently for
> no apparent reason. I can’t tell you how many times I’ve been in
> meetings that have included students and they ask me why this keeps
> happening. It has been an issue for a long time. Some of them have been
> explainable. For example, if the machine does get hosed with malware, it
> slows down the agent registering when it comes on the network. Thing is
> most of the complaints are from Mac users who don’t tend to have many
> malware issues. We may be more anal about the end user experience than
> other schools though as it sounds like other schools either don’t have
> the problem, don’t notice, or just aren’t bothered by it. We try to keep
> the end user experience as seamless and predictable as we possibly can.
Likewise, this is the biggest complaint here. We, too, are pretty
concerned about the end-user experience, and this one is certainly an
annoyance.
>
> 4. Is administration easier?
>
> I would say it is generally easier than our previous system, but I can’t
> compare that to Cisco.
I probably ought not to compare with Cisco, as we never advanced to CCA
version 4, keeping to version 3.5 or 3.6 until we switched altogether.
We're not a Cisco network, so had to run in-band...
We were also
> frustrated by the fact that there are a lot of things we can’t see and
> control. However, their model is more of an outsourced model. This has
> been hard for us to adjust to after doing it ourselves. I can understand
> why they want to protect the system from being messed with. The other
> good thing is that they are willing to deal directly with our first line
> help desk, and even end users when troubleshooting a problem. And, we
> have had our share of bugs, outages and unexplained problems.
> Fortunately none of those ever occurred during opening when we are
> trying to impress the parents spending the big bucks. And regarding
> that, they do understand the unique needs of the education space which
> isn’t true for all vendors. During opening they are staffed up and
> available in case there are problems. They also time upgrades to do over
> the summer or over the Christmas break. They have improved in their QA,
> but I think there is still more room for improvement there.
One thing we requested was a SQL data export. Safeconnect updates a
MySQL database on one of our servers every hundred events or so. I then
have used this database for a more complete record of events than is
often shown in the management GUI, and also join the authentication data
with LDAP and ResEd data, so I can look up an IP address and get name,
email address, dorm location, etc. all in one fell swoop. ImpulsePoint
was quite cooperative in getting that going.
>
> 5. How long did it take to complete implementation?
>
Technically, our implementation was pretty smooth. We spent more time on
the political aspects of switching from a passive NAC to one requiring a
local agent installation. If you're making the same step, I can't
emphasize this point too highly.
--
Best regards
-- Cal Frye, Network Administrator, Oberlin College
Mudd Library, x.56930 -- CIT will NEVER ask you for your password!
www.calfrye.com, www.oberlin.edu/cit/
"We can have concentrated wealth in the hands of a few, or we can have
democracy, but we cannot have both." -- Supreme Court Justice Louis
Brandeis.
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
