[26508] in resnet
Re: NAC solution removal
daemon@ATHENA.MIT.EDU (GD)
Tue Jun 14 10:38:30 2011
MIME-version: 1.0
Content-type: multipart/alternative; boundary="Boundary_(ID_haM41k1nYtiyCkVZjtSjqA)"
Message-ID: <4DF7725C.5010901@wmich.edu>
Date: Tue, 14 Jun 2011 10:38:20 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: GD <gaurav.dave@WMICH.EDU>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <648355A0EA9BCE4C8E867D496C8F41B54AC56695@Abel.stmartin.edu>
This is a multi-part message in MIME format.
--Boundary_(ID_haM41k1nYtiyCkVZjtSjqA)
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7BIT
Jordan,
If I may ask, why are you getting rid of the Bradford NAC?
Gaurav Dave
Network Programmer
Western Michigan University
Office of Information Technology
Phone: 269-387-5468
--
On 6/14/2011 10:35 AM, Boland, Jordan wrote:
>
> My last institution didn't employ a NAC, but instead used a homebrew client registration system to help keep order.
> MAC addresses were registered into a database, and VMPS was used to assign machines to the correct VLAN when they
> connected. Machines showing 'interesting' behavior or subject to a policy sanction were either assigned to a jail
> VLAN or ignored completely (switchport can be disabled remotely via VMPS as well).
>
> At SMU, we are in the process of removing our Bradford NAC and replacing it with a system similar to the one described
> above. Because we are not a cisco shop (and VMPS is deprecated) we are employing 802.1x MAC address authentication
> and dynamic VLAN assignment via RADIUS. The system is designed to be a full-campus solution, but could be deployed to
> ResNet only if desired.
>
> At this time, all proof-of-concept and integration tests have been completed, and I am in the process of finishing the
> management scripts and registration user interface. Notes and code can be made available to any interested parties.
>
> As far as why we are doing this, I find the cost of implementing the NAC is too much considering what we get out of
> it. While the 802.1X/RADIUS/DVA solution does not provide me with the same level of control that the NAC does, it
> also doesn't require the client software that seems to degrade our user experience so much. I want to be able to
> identify a machine on a network as belonging to a particular student, and take enforcement measures if necessary.
> Since this provides me with a big "Internet kill switch" on each machine, it works well enough for my purposes.
>
> -Jordan
>
> Network Administrator
>
> Saint Martin's University
>
> 5300 Pacific Ave SE
>
> Lacey, WA 98503-7500
>
> (360) 486-8838
>
> jboland@stmartin.edu
>
> *From:*Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] *On Behalf Of *Michael P Hizny
> *Sent:* Tuesday, June 14, 2011 5:29 AM
> *To:* RESNET-L@LISTSERV.ND.EDU
> *Subject:* NAC solution removal
>
> After having a NAC solution in place for the last 8 years, we are re-evaluating whether or not we really need to
> support a solution of this type anymore. Have any other Universities done, or considered removing their NAC solution?
>
> /Michael Hizny/
>
> /Binghamton Univeristy/
>
> ___________________________________________________ You are subscribed to the ResNet-L mailing list.
>
> To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html
> ___________________________________________________
>
> ___________________________________________________ You are subscribed to the ResNet-L mailing list.
>
> To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html
> ___________________________________________________
>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--Boundary_(ID_haM41k1nYtiyCkVZjtSjqA)
Content-type: text/html; charset=ISO-8859-1
Content-transfer-encoding: 7BIT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Jordan, <br>
<br>
If I may ask, why are you getting rid of the Bradford NAC?<br>
<br>
Gaurav Dave<br>
Network Programmer<br>
Western Michigan University<br>
Office of Information Technology<br>
Phone: 269-387-5468<br>
<tt>--</tt><br>
<br>
On 6/14/2011 10:35 AM, Boland, Jordan wrote:
<blockquote
cite="mid:648355A0EA9BCE4C8E867D496C8F41B54AC56695@Abel.stmartin.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">My last institution didn’t employ a NAC, but
instead used a homebrew client registration system to help
keep order. MAC addresses were registered into a database,
and VMPS was used to assign machines to the correct VLAN
when they connected. Machines showing ‘interesting’
behavior or subject to a policy sanction were either
assigned to a jail VLAN or ignored completely (switchport
can be disabled remotely via VMPS as well).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">At SMU, we are in the process of removing our
Bradford NAC and replacing it with a system similar to the
one described above. Because we are not a cisco shop (and
VMPS is deprecated) we are employing 802.1x MAC address
authentication and dynamic VLAN assignment via RADIUS. The
system is designed to be a full-campus solution, but could
be deployed to ResNet only if desired.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">At this time, all proof-of-concept and
integration tests have been completed, and I am in the
process of finishing the management scripts and registration
user interface. Notes and code can be made available to any
interested parties.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">As far as why we are doing this, I find the cost
of implementing the NAC is too much considering what we get
out of it. While the 802.1X/RADIUS/DVA solution does not
provide me with the same level of control that the NAC does,
it also doesn’t require the client software that seems to
degrade our user experience so much. I want to be able to
identify a machine on a network as belonging to a particular
student, and take enforcement measures if necessary. Since
this provides me with a big “Internet kill switch” on each
machine, it works well enough for my purposes.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">-Jordan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">Network Administrator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">Saint Martin's University<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">5300 Pacific Ave SE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">Lacey, WA 98503-7500<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">(360) 486-8838<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><a class="moz-txt-link-abbreviated" href="mailto:jboland@stmartin.edu">jboland@stmartin.edu</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><o:p> </o:p></span></p>
<div>
<div style="border-right: medium none; border-width: 1pt
medium medium; border-style: solid none none; border-color:
rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color;
padding: 3pt 0in 0in;">
<p class="MsoNormal"><b><span style="font-size: 10pt;
font-family:
"Tahoma","sans-serif";">From:</span></b><span
style="font-size: 10pt; font-family:
"Tahoma","sans-serif";"> Resnet
Forum [<a class="moz-txt-link-freetext" href="mailto:RESNET-L@LISTSERV.ND.EDU">mailto:RESNET-L@LISTSERV.ND.EDU</a>]
<b>On Behalf Of </b>Michael P Hizny<br>
<b>Sent:</b> Tuesday, June 14, 2011 5:29 AM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L@LISTSERV.ND.EDU</a><br>
<b>Subject:</b> NAC solution removal<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);">After having a NAC solution in place for the last
8 years, we are re-evaluating whether or not we really need
to support a solution of this type anymore. Have any other
Universities done, or considered removing their NAC
solution?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"> </span><o:p></o:p></p>
<p class="MsoNormal"><i><span style="font-size: 10pt;
font-family: "Arial","sans-serif";
color: rgb(31, 73, 125);">Michael Hizny</span></i><o:p></o:p></p>
<p class="MsoNormal"><i><span style="font-size: 10pt;
font-family: "Arial","sans-serif";
color: rgb(31, 73, 125);">Binghamton Univeristy</span></i><o:p></o:p></p>
<p class="MsoNormal">___________________________________________________
You are subscribed to the ResNet-L mailing list.
<o:p></o:p></p>
<p>To subscribe, unsubscribe or search the archives, go to <a
moz-do-not-send="true"
href="http://LISTSERV.ND.EDU/archives/resnet-l.html">
http://LISTSERV.ND.EDU/archives/resnet-l.html</a>
___________________________________________________
<o:p></o:p></p>
</div>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to <a class="moz-txt-link-freetext" href="http://LISTSERV.ND.EDU/archives/resnet-l.html">http://LISTSERV.ND.EDU/archives/resnet-l.html</a>
___________________________________________________
</p>
</blockquote>
</body>
</html>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--Boundary_(ID_haM41k1nYtiyCkVZjtSjqA)--
