[26510] in resnet
Re: NAC solution removal
daemon@ATHENA.MIT.EDU (Mike McKenna)
Tue Jun 14 11:23:23 2011
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-ID: <LISTSERV%201106141121400863.164F@LISTSERV.ND.EDU>
Date: Tue, 14 Jun 2011 11:21:40 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Mike McKenna <mmckenna@MILTON.EDU>
To: RESNET-L@listserv.nd.edu
Gaurav,
I am a Bradford site (one of their first customers). I am also weighing the
benefits of the product. My primary issue is the support, specifically the lack
of follow thru. In my opinion the user experience is degraded because erratic
role & VLAN changes.
I'm watching with interest the Aruba switch offering that will be available in the
near future which will have an integrated NAC solution
Mike McKenna
Network Services, Mgr
Milton Academy
170 Centre St
Milton, MA 02186
On Tue, 14 Jun 2011 10:38:20 -0400, GD <gaurav.dave@wmich.edu> wrote:
>Jordan,
>
>If I may ask, why are you getting rid of the Bradford NAC?
>
>Gaurav Dave
>Network Programmer
>Western Michigan University
>Office of Information Technology
>Phone: 269-387-5468
>--
>
>On 6/14/2011 10:35 AM, Boland, Jordan wrote:
>>
>> My last institution didn't employ a NAC, but instead used a homebrew client
registration system to help keep order.
>> MAC addresses were registered into a database, and VMPS was used to
assign machines to the correct VLAN when they
>> connected. Machines showing 'interesting' behavior or subject to a policy
sanction were either assigned to a jail
>> VLAN or ignored completely (switchport can be disabled remotely via VMPS
as well).
>>
>> At SMU, we are in the process of removing our Bradford NAC and replacing
it with a system similar to the one described
>> above. Because we are not a cisco shop (and VMPS is deprecated) we are
employing 802.1x MAC address authentication
>> and dynamic VLAN assignment via RADIUS. The system is designed to be a
full-campus solution, but could be deployed to
>> ResNet only if desired.
>>
>> At this time, all proof-of-concept and integration tests have been
completed, and I am in the process of finishing the
>> management scripts and registration user interface. Notes and code can be
made available to any interested parties.
>>
>> As far as why we are doing this, I find the cost of implementing the NAC is
too much considering what we get out of
>> it. While the 802.1X/RADIUS/DVA solution does not provide me with the
same level of control that the NAC does, it
>> also doesn't require the client software that seems to degrade our user
experience so much. I want to be able to
>> identify a machine on a network as belonging to a particular student, and
take enforcement measures if necessary.
>> Since this provides me with a big "Internet kill switch" on each machine, it
works well enough for my purposes.
>>
>> -Jordan
>>
>> Network Administrator
>>
>> Saint Martin's University
>>
>> 5300 Pacific Ave SE
>>
>> Lacey, WA 98503-7500
>>
>> (360) 486-8838
>>
>> jboland@stmartin.edu
>>
>> *From:*Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] *On Behalf Of
*Michael P Hizny
>> *Sent:* Tuesday, June 14, 2011 5:29 AM
>> *To:* RESNET-L@LISTSERV.ND.EDU
>> *Subject:* NAC solution removal
>>
>> After having a NAC solution in place for the last 8 years, we are re-
evaluating whether or not we really need to
>> support a solution of this type anymore. Have any other Universities done,
or considered removing their NAC solution?
>>
>> /Michael Hizny/
>>
>> /Binghamton Univeristy/
>>
>> ___________________________________________________ You are
subscribed to the ResNet-L mailing list.
>>
>> To subscribe, unsubscribe or search the archives, go to
http://LISTSERV.ND.EDU/archives/resnet-l.html
>> ___________________________________________________
>>
>> ___________________________________________________ You are
subscribed to the ResNet-L mailing list.
>>
>> To subscribe, unsubscribe or search the archives, go to
http://LISTSERV.ND.EDU/archives/resnet-l.html
>> ___________________________________________________
>>
>
>___________________________________________________
>You are subscribed to the ResNet-L mailing list.
>
>To subscribe, unsubscribe or search the archives,
>go to http://LISTSERV.ND.EDU/archives/resnet-l.html
>___________________________________________________
>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
