Deploying an Identity Aware Network

Recommendations

Info

Extreme Networks Application NoteSteps: Finally, click on “Save Changes” to save the device (enabled for monitoring) into the EPICenter configuration.NOTESAfter this step, it is important to revisit the ExtremeXOS configuration and ensure that Identity Management is enabled only on the portsthat we are interested in. This is because EPICenter enables Identity Management on all the ports on the switch. Recollect that in thistopology we are interested in tracking identities only on ports that connect to the clients. This is to ensure that the switch does not tracka large number of backend servers that are in the upstream enterprise network.© 2010 Extreme Networks, Inc. All rights reserved. Identity Aware Network—Page 20
Extreme Networks Application Note4.2.4. Client ConfigurationsThe following table summarizes the client configurations and connections used in this case study.Table 5:• IP Address, Default Gateway, Name/WINS Servers: Dynamically assigned by DHCP• NetBIOS Host Name: workstation1John Smith PCJohn Smith VoIP PhoneBob Stone LaptopLaptop Used forWeb-based AuthenticationTraffic Generators toSimulate MAC-basedAuthentication• Authentication Method: IEEE 802.1X [Please refer to client configuration steps described in document“Application Note: Using ExtremeXOS NetLogin with Microsoft IAS” for configuring the client toperform authentication using EAP-MD5-Challenge.]• Connected to edge switch on port #13• IP Address, Default Gateway, Name/WINS Servers: Dynamically assigned by DHCP.• Authentication Method: MAC-based• Connected to edge switch on port #23• IP Address, Default Gateway, Name/WINS Servers: Dynamically assigned by DHCP• NetBIOS Host Name: laptop1• Authentication Method: IEEE 802.1X [Please refer to client configuration steps described in document“Application Note: Using ExtremeXOS NetLogin with Microsoft IAS” for configuring the client toperform authentication using EAP-MD5-Challenge.]• Connected to edge switch on port #14• IP Address, Default Gateway, Name Servers: Dynamically assigned by DHCP• Hostname: laptop2• Connected to edge switch on port #17• Traffic with source MAC addresses 00:00:00:FE:ED:01 and 00:00:00:FE:ED:02 are sent to portsnumbered 21 and 22 respectivelyOnce all the client configurations have been done, we can now allow all the clients to logon to the network depending on theauthentication method used. While some methods (such as IEEE 802.1X EAP-MD5-Challenge) require human/user interventionto complete the logon process, others such as MAC-based authentication methods would only require the client togenerate traffic. In the subsequent sections, we will examine the discovery of identities and the information collected aboutthe same.We will omit the steps required to verify the status of authentication of clients at both the edge switch and the backend IASserver. Please refer to the document “Application Note: Using ExtremeXOS NetLogin with Microsoft IAS” for more comprehensivedetails about the information available at the edge switch and the authentication servers for verifying and troubleshootingthe authentication process for various methods. Hence forth, we will assume that all clients have been successfully authenticated(and authorized).4.2.5. Tracking Identities of Desktop/Workstation UsersIn this section we will examine the various attributes of human user identities and the identities of the devices they use. Wewill also observe the co-relation of information done by the ExtremeXOS switch.4.2.5.1. Information Available at the Edge SwitchIn this section, we will examine the various CLI commands provided by ExtremeXOS to retrieve information about user/device identities. While ExtremeXOS CLI provides detailed information for monitoring, debugging and troubleshooting, it ishighly recommended to use EPICenter for a centralized view of identities throughout the network.© 2010 Extreme Networks, Inc. All rights reserved. Identity Aware Network—Page 21
Page 1 and 2: Extreme Networks Application NoteDe
Page 3 and 4: Extreme Networks Application NoteTa
Page 5 and 6: Extreme Networks Application Note3.
Page 11 and 12: Extreme Networks Application Noteco
Page 13 and 14: Extreme Networks Application NoteSt
Page 19: Extreme Networks Application NoteSt
Page 31 and 32: Extreme Networks Application NoteTh
Page 35 and 36: Extreme Networks Application Note©
Page 39 and 40: Extreme Networks Application NoteDe
Page 59 and 60: Extreme Networks Application Note<r
Page 61 and 62: Extreme Networks Application Note<c
Page 63 and 64: Extreme Networks Application NoteBe
Page 65 and 66: Extreme Networks Application Note*
Page 67 and 68: Extreme Networks Application NoteTo

Deploying an Identity Aware Network

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?