Managing user access through NAC

Transcription

1 Managing user access through NAC Darren Wheatcroft Senior Systems Developer, Information Services University of Nottingham 30 th June 2010

2 Contents Development of NAC at the University of Nottingham Guest Wi-Fi project Additional benefits of NAC (Network Access Control) Future plans

3 Network Overview 8500 rooms, 24 halls of residence, 3 main sites Mixture of University owned & 3 rd Party managed Non-university residents Other students Conferences Visitors International students

4 Life before Campus Manager Resource-intensive Manual student registration Queues and delays at start of term Helpdesk overloaded Network performance Complaints from students

5 Selection of solution & vendor Influencers on vendor selection Other Network Access Control Suppliers - Unclear licensing requiring add-on for a full solution - No understanding of environment Bradford Networks & Khipu-Networks - Understanding of the Education sector needs - Technical experience and Commercial expertise - Good working relationship

6 Installation Summer 2004 initial rollout Rollout staged hall-byhall Summer 2005 full rollout entire residential network 3 rd Party halls Infections down 70% Summer 2008 upgrade to new hardware High-availability Remote scanning Controlled visitor access Summer 2010 Remote registration Wireless Automation

7 Student Network Service Remote registration Saves time on arrival Better idea of types of user/os coming Offsite registration valid for 14 days Visitor registration Conference guests, student visitors etc Simple scan Wireless registration Simple scan, ease of use.

8 Student Network Service

9

10

11 Guest wireless (Sept 2008) Requirements Simple to use No complicated sign-up Re-use existing infrastructure Solution Using Bluesocket authentication server Registration by address UoN-guest Introduced 2008

12 Issues No checking of credentials Students prefer to use it over official wireless Limited audit capabilities Unencrypted browsing JANet considerations Resolved using commercial pipe. Some good points: Simple to use Port restrictions help with security

13 Development requirements Encrypted browsing WPA2-PSK initially Audit trail of users & machines Prevent student use Keep costs down KISS

14 Guest wireless (June 2010) Campus Manager integration Fits with overall plan for campus wide NAC Proven - already in use on ResNet In-house expertise & excellent vendor support Potential to expand to other areas (NAC) Future 802.1X use. Answers all development requirements

15 Additional benefits Device discovery passive & active 50,000 devices in our system registration database Track & locate Posture checking What OS s are out there Who has AV What software? IP Schema rationalisation Improve System registration process Better allocation of resources

16 Master server (NS500) Connects all NAC islands Off-site & consolidated registration SNS wireless campus UK China Malaysia = single license pool = single policy configuration (eventually) = single registration interface

17 Dashboard

18 Future options Persistent Agent Live checking of system Skip regular scanning delays Extending NAC to Main Campus network 50,000 potential devices Simplifying DNS & DHCP Wireless network access Identity & Security Role based networking International deployment

19 Questions (0115)