Instructor: NAC Configuration. 2 2
In the last lesson, I just briefly introduced the concept 3 3
of network access control. 4 4
Network access control provides the means 5 5
to authenticate users and evaluate device integrity 6 6
before a network connection is permitted. 7 7
Now, NAC relies on something known as 802.1X. 8 8
802.1X Is a standard for encapsulating EAP, 9 9
which is the extensible authentication protocol, 10 10
and its communications over a LAN or wireless LAN 11 11
and it provides port-based authentication. 12 12
Now, this brings up the concept 13 13
of what is port-based authentication and port-based NAC. 14 14
Now, port-based NAC is when a switch or router 15 15
can perform some sort of authentication 16 16
of the attached device before we activate that port. 17 17
So if I just plug into a port and it has 802.1X 18 18
and port-based NAC on it, and I'm not approved, 19 19
it's not going to do anything, but if I am approved, 20 20
it's going to go through a process and let me on the network. 21 21
Let's talk a little bit about how that works. 22 22
When a supplicant, 23 23
which is the name for the host who's requesting access, 24 24
goes onto the network, 25 25
they're going to communicate using EAPOL, 26 26
which is the Extensible Authentication Protocol 27 27
over LAN Protocol with EAP inside of it. 28 28
It's going to go to the authenticator, 29 29
which is that switch that we're talking to. 30 30
That switch then takes that request 31 31
and sends it using a protocol 32 32
over to an authentication server. 33 33
Usually this uses something 34 34
like radius or diameter as the protocol. 35 35
Once the authenticator sends the credentials 36 36
from the supplicant to the authentication server, 37 37
it's going to wait for a response. 38 38
If the authentication server checks their credentials 39 39
and grants access or denies access, 40 40
that is going to be sent back to the network access device, 41 41
in this case, the authenticator or the switch in my diagram. 42 42
Now, if access is granted, 43 43
that supplicant then gets rerouted 44 44
over to the internet or other LAN resources 45 45
or the right VPN tunnel or to the appropriate VLAN, 46 46
that allows them to do what they need to do. 47 47
Now, if they're denied, they're put into a separate area 48 48
which is basically quarantine or holding, 49 49
or they can just be rejected altogether. 50 50
Now, what I just showed you is the simplest form of 802.1X 51 51
but we can actually use a broader NAC solution 52 52
that allows administrators to devise policies or profiles 53 53
describing a minimum security level configuration 54 54
that all the devices must meet 55 55
before being granted network access. 56 56
What I just showed you was a very basic model 57 57
that relied on a username and password, 58 58
but if we go to a broader NAC solution, 59 59
we can test for many different things. 60 60
So what are some key features of a NAC solution? 61 61
Well, we might have a posture assessment, 62 62
we might have remediation, 63 63
and we might have pre and post-admission controls. 64 64
Let's talk about each of these. 65 65
First, we have a posture assessment, 66 66
and this is the process of assessing the endpoint 67 67
for compliance with the health policy. 68 68
Now, when we talk about the health policy, 69 69
this is a list of things that we're going to check that device 70 70
and see if it has and if it meets those things. 71 71
For instance, I might check and make sure 72 72
that I run up any virus scan 73 73
so they're not bringing any malware into my network. 74 74
I might check the firmware level or the OS patch level 75 75
of that device that's tryna connect. 76 76
I might check if they have a host-based firewall 77 77
or host-based IDS, 78 78
or that they have an up-to date antivirus definitions 79 79
on that machine. 80 80
I can scan their registry 81 81
or perform a file signature verification. 82 82
There's all sorts of things you can put 83 83
as part of this health policy, 84 84
but essentially, during the posture assessment 85 85
when you connect to my network, I'm going to check your device 86 86
and see if you meet my standards. 87 87
Next, we go into remediation. 88 88
Now, if you don't meet my standards, 89 89
this is the process and procedures that occurs 90 90
when your device doesn't meet the minimum security policy. 91 91
For instance, let's say your antivirus was out of date, 92 92
we might give you the latest virus definitions, 93 93
run another scan, and when that passes, 94 94
then we would say, "You now meet the requirements 95 95
and you can go back and be admitted to my network." 96 96
Next, we have pre and post-admission control. 97 97
This is the point 98 98
at which the client devices are granted or denied access 99 99
based on their compliance with the health policy. 100 100
So again, your laptop connects to my network. 101 101
We look at your computer, we say, 102 102
"You don't have the latest things we want." 103 103
We put you into remediation. 104 104
At this point, this was a pre-admission control. 105 105
We said, "You don't meet our standards. 106 106
Go over here and get fixed up." 107 107
Then once you meet those standards 108 108
and we allow you to connect, that becomes post-admission. 109 109
We're going to admit you to the network 110 110
and make sure you're there. 111 111
Now, post-admission might be doing additional checks 112 112
on you periodically. 113 113
For instance, if you connect your laptop to my network, 114 114
maybe every four hours, I'm going to check again and say, 115 115
"Do you have the latest security updates? 116 116
Do you have the latest antivirus?" 117 117
And if you remain compliant, you get to stay here. 118 118
If you're not, we might pull you off 119 119
and put you in remediation again. 120 120
All of this is going to be based on your health policy 121 121
and the endpoint health policy is just one 122 122
of the different rule-based methods that you can use 123 123
for granting or denying access. 124 124
There's more than just the health policy, though. 125 125
We can do it based on other features too. 126 126
For instance, I might use time-based, location-based, 127 127
role-based, or rule-based methods to allow you to access 128 128
or deny you access to my network. 129 129
When I deal with time-based, 130 130
this is going to define access periods 131 131
for given hosts on using a time-based schedule. 132 132
For example, you might work in a company 133 133
that only operates from nine to five, 134 134
and so if you try to log in at two in the morning, 135 135
you could be denied access. 136 136
Now, in my company, that wouldn't work 137 137
because I have employees on both sides of the world, 138 138
and so while I'm sleeping at two in the morning, 139 139
so my employees over in Asia 140 140
are actually accessing our networks, 141 141
but we can make it so that they can only access 142 142
during their daytime hours 143 143
and we can only access during our daytime hours. 144 144
That would be a method of doing that 145 145
that would be time-based. 146 146
We also could do this based on location, 147 147
this is called location-based. 148 148
Now, with location-based, we're going to evaluate the location 149 149
of the endpoint requesting access using geolocation 150 150
of its IP, it's GPS, or other mechanisms. 151 151
For example, if I know 152 152
that one of my employees always logs in from Florida 153 153
but now all of a sudden their login credentials 154 154
are being logged in from Italy, 155 155
that would be something that will be flagged 156 156
and we might put them into remediation until we figure out 157 157
if they're really the right person. 158 158
Maybe that person's on vacation 159 159
and they are accessing from Italy, 160 160
or maybe somebody's hacked their credentials 161 161
and they're tryna log in as them. 162 162
Both of those would be things that we could catch 163 163
using location-based access. 164 164
Then we have role-based. 165 165
Role-based is a NAC method 166 166
that reevaluates a device's authorization 167 167
when it's being used to do something. 168 168
This is also known as adaptive NAC. 169 169
For example, if your device tries to join a subnet 170 170
that's used for server management 171 171
and it's on a user account and a user laptop, 172 172
it's going to be rejected, 173 173
but if I tried to connect a server to that domain, 174 174
it would allow that to happen 175 175
because that is an authorized function. 176 176
And so that's the idea here with adaptive NAC, 177 177
we look at the role of something 178 178
and figure out if it's something 179 179
that it should be allowed to do. 180 180
And then the last one is a rule-based. 181 181
Now, rule-based is a complex admission policy 182 182
that might enforce a series of rules 183 183
and we basically write these 184 184
with a bunch of logical statements. 185 185
If this, then this... 186 186
If this and this... 187 187
If this or this... 188 188
So for instance, if Jason and instructor, 189 189
let him in this access, 190 190
if Jason and student, deny him this access, 191 191
that's the idea of a rule-based. 192 192
Now, that's obviously a very simple example 193 193
but you get the idea. 194 194
The idea here is we want to make a policy 195 195
based on a series of rules 196 196
and then allow or deny people based on those things.