Alcatel OS6400-24 Uživatelský manuál stáhnout pdf (Strana 2)

Alcatel-Lucent Operating System for OmniSwitch LAN Switches with Integrated CyberGatekeeper Solution | Data Sheet

Access Guardian AOS feature, and

allowed access only to the remediation

servers. The HIC agent (permanently

installed or provided on-demand) on

the endpoint, in conjunction with the

InfoExpress CyberGatekeeper policy

server, attempts to update the endpoint.

Once compliant with security policies,

the endpoint is allowed network access.

As long as the endpoint is connected

to the network infrastructure, the HIC

agent provides continuous surveillance.

If the agent detects a violation of the

ecurity policies or is disabled or

terminated, the policy server will notify

the switch, which in turn quarantines

the endpoint and allows access only

to the remediation servers.

The OmniSwitch 6400 SGS/OmniSwitch

6850 SLS/InfoExpress CyberGatekeeper

solution is easy to deploy and maintain,

requiring no network changes.

Installations can be done in hours

compared to those for most network

access control solutions that can take

weeks or months.

User network profile

When a device initially connects

to the enterprise network edge,

the OmniSwitch 6400 SGS or the

OmniSwitch 6850 SLS authenticates

the user/device as defined by its Access

Guardian policy. The OmniSwitch 6400

or OmniSwitch 6850 subsequently iden -

tifies the corresponding user network

profile (UNP), which is a security profile.

UNPs allow the creation of easily

defined profiles that are mapped to

security policies. A profile may contain

network, application, priority, band -

width and compliancy rules based on

a user’s role in the organization. The

UNP is provided during authentication

and rules are enforced immediately by

the network switch. During this time,

the switch allows the endpoint limited

ccess to the network. Authentication

using 802.1X, MAC or web-based

methods is not required, but can be

added to provide more granular

control of the profiles.

Operation

When a user/device connects to an

enterprise network with HIC, the

endpoint device is required to undergo

a verification process. The switch

dynamically restricts network access

using ACLs, which only allow the

endpoint access to the InfoExpress

CyberGatekeeper Policy Server and

the remediation server(s).

If the endpoint device has a permanent

InfoExpress CyberGatekeeper Agent

installed, the agent communicates with

the InfoExpress CyberGatekeeper Policy

Server to assess the endpoint’s integrity.

The tests to be performed on the

endpoint device by both the permanent

agent and the web-based on-demand

agent are defined on the InfoExpress

CyberGatekeeper Policy Server using

the InfoExpress CyberGatekeeper Policy

Manager. The policy server determines

whether the endpoint device has passed

or failed the HIC test and directly

notifies the edge OmniSwitch 6400 SGS

or OmniSwitch 6850 SLS to which the

device is connected. Traffic restrictions

and redirections are processed by the

Alcatel-Lucent Access Guardian AOS

eature, which integrates authentication,

device compliance and network access

control functions directly into the net -

work infrastructure at the switch level.

If the OmniSwitch 6400 SGS or the

OmniSwitch 6850 SLS receives a HIC

pass status for the specified endpoint

device, the switch dynamically applies a

new set of ACLs that allow the endpoint

device access to the production network.

If the OmniSwitch 6400 SGS or the

OmniSwitch 6850 SLS receives a HIC

fail status for the specified endpoint

device, the switch dynamically applies

a restrictive set of ACLs that allow the

endpoint to access the remediation

servers only.

If the endpoint device does not have

a permanent agent installed on it, the

user is required to launch a browser

that is redirected to a customer-defined

User network proﬁles

• Role-based access including

VLAN, QoS, ACL

Trafﬁc anomaly detection

• Zero day attack

AQM

• Quarantine and

remediation

Host integrity check

• Integrated HIC (CyberGateKeeper)

static or on-demand agents

Authentication

• Employee: 802.1x

• Guest: captive portal

• IP phone: 802.1x or Mac-based

• Printer: port-based

Access guardian

• Monitoring/audit trail

Privilege

OmniSwitch embedded

network security

framework

Visibility

IntegrityIdentity

Threats controlIsolation

Figure 1. OmniSwitch AOS - Embedded network security framework

1 2 3 4

Komentáře k této Příručce

Žádné komentáře

Alcatel OS6400-24 Uživatelský manuál Strana 2

Komentáře k této Příručce

Související produkty a manuály pro Sítě Alcatel OS6400-24