[27829] in resnet
Re: NAC Solutions
daemon@ATHENA.MIT.EDU (Nick Werder)
Wed Jul 18 12:21:01 2012
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-ID: <BAC01575B6E3E44892A9EEC9A17BCCE8517FAD44@DSAEXMB.housing.ufl.edu>
Date: Wed, 18 Jul 2012 16:19:34 +0000
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Nick Werder <NickW@housing.ufl.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <5006BD5C.8050800@american.edu>
Although SafeConnect does not do checks for Flash, Java, etc, it is quite simple to write custom policies to accomplish this. Considering that a plethora of compromises are a result of outdated Flash or Java we have been enforcing these policies for quite some time now.
Nick Werder | Network Security Administrator
University of Florida Department of Housing and Residence Education
PO Box 112100 | Gainesville, FL 32611-2100
office 352.392.2171 x10126 | fax 352.392.6819 | NickW@housing.ufl.edu
StrengthsQuest Top 5: Achiever, Deliberative, Learner, Maximizer, Relator - Find out more - http://www.strengthsquest.com/content/141728/index.aspx
Please consider the environment before printing this email.
-----Original Message-----
From: Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] On Behalf Of Isabelle Graham
Sent: Wednesday, July 18, 2012 9:43 AM
To: RESNET-L@LISTSERV.ND.EDU
Subject: Re: NAC Solutions
We had been a Cisco Clean Access customer for several years (deployed
campus-wide) and moved to Impulse SafeConnect a year ago. We've been much happier with their support and find they are an all around better fit for a higher ed environment.
A few key points off hand:
1. The biggest challenge for us to implement was coordinating with our network engineering team. Impulse was very good about working with them directly and facilitating this and it wasn't really a big deal, it was just the most complicated thing we had to do logistically.
2. We're not using them for 802.1x authentication (currently only on wireless, Aruba --> Radius --> AD), but are using them for posture assessment all use segments of wired and wireless. We had to do a bit of trickery in order to set up support for non-802.1x devices on wireless, but Impulse was very helpful in getting that set up.
3. We're also not using their guest registration system as we had our own (home-grown) already in place and working well.
4. Our one outstanding pain point is lack of support for checking third party/plug-in type products (Java, Flash, Reader). Impulse is interested in trying to address this but hasn't had much luck working with the vendors. To be fair, no NAC solution we've found currently does this.
On the whole I think our biggest advantage was already having ubiquitous NAC and so having a good idea of what we wanted and needed from the new system. Feel free to ping me directly if you have any questions.
Isabelle Graham
Information Security Engineer
American University
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
