Deploying an Identity Aware Network

Recommendations

Info

Extreme Networks Application Note1. IntroductionThis document describes the building blocks and configurationtools provided by Extreme Networks ExtremeXOSbased switches and EPICenter network managementsoftware to plan and deploy an identity aware network.In the most basic form, an identity can be constructedusing the attributes in the credentials presented by a useror device during the authentication or connection process.Traditionally, credentials of users and devices have alwaysbeen identified using an account name and optionalpassword, and a realm. Microsoft Server technologiesintroduce the concept of a domain, which is the realm theuser or device belongs to. In a typical Microsoft Serverbased network, a domain also contains identities ofdevices such as workstations, laptops, printers, and so on.While these basic attributes of an identity are mostlysufficient for management of users/devices, they fall shortof addressing some of the key demands on today’senterprise network:• Reducing IT support costs in enterprises:Shortening the time taken to troubleshoot and locatethe users or devices in the network, determine theauthentication method used and status of authentication,and determine authorizations (such as VLANmemberships) can drastically reduce the time takenfor IT support personnel to troubleshoot problemsreported by users.• Reducing compliance and audit costs:Detailed reports which include user logon and logofftimes, status of authentication, and authorizationsprovided to access network and IT resources can aidin internal audits and should be able to provide thenecessary data for compliance audits. Informationcollected from the network needs to be archived sothat it can be easily retrieved at any point in time.• Building custom enterprise applications whicheffectively use information provided by the networkThe Identity Management feature addresses theserequirements by:1. Extending the definition of an identity to include thefollowing attributes:• Windows Active Directory Domain Attributes:account name, realm/domain• Authentication method used: IEEE 802.1X, Webbased,MAC-based• MAC address of the client• IP address assigned to the client• NetBIOS host name of the client• LLDP capability• IP-address of the NAS (edge switch) device• Time at which the user or device was discovered• Logon and logoff time (if applicable)2. Providing a network-wide view of identities inEPICenter.• Ability to collect and monitor identities across theenterprise network• Archival of user and device activities, which can beretrieved easily at any time• Detailed reports which can aid in preparing informationrequired for compliance and internal-audits3. Industry standard interface and extensions to buildand integrate with custom applications.• Well-defined XML APIs and Schema to retrieveinformation from ExtremeXOS• Ability to PUSH identity information fromExtremeXOS to XML based• Secure communication of identity information usingSSL/TLSSection 3 Identity Aware Network provides an overview ofthe feature and capabilities. A case study is discussed inSection 4 describing the configuration and setup of all thecomponents in the network. Section 5 Business ProcessIntegration describes the procedures to retrieve informationin the form of reports, and how the ExtremeXOS XMLAPIs/Schemas can be used to integrate with customapplications.2. References1. Application Note: Using ExtremeXOS NetLogin withMicrosoft IAS http://www.extremenetworks.com/apps/whitepaper?wpurl=/libraries/whitepapers/ANExtremeXOSNetLogin_1644_01.pdf.zip&Ctype=WhitePaper2. ExtremeXOS Concepts Guide, Software Version 12.4http://www.extremenetworks.com/services/software-userguide.aspx3. ExtremeXOS Command Reference Guide, SoftwareVersion 12.4 http://www.extremenetworks.com/services/software-userguide.aspx4. ExtremeXOS InSite, Software Developers Kit http://www.extremenetworks.com/solutions/Insite.aspx© 2010 Extreme Networks, Inc. All rights reserved. Identity Aware Network—Page 4
Extreme Networks Application Note3. Identity Aware NetworkThe diagram below exemplifies the concept of identity as explained in the previous section.Figure 1: Attributes of an Identity© 2010 Extreme Networks, Inc. All rights reserved. Identity Aware Network—Page 5
Page 1 and 2: Extreme Networks Application NoteDe
Page 3: Extreme Networks Application NoteTa
Page 7 and 8: Extreme Networks Application Note4.
Page 11 and 12: Extreme Networks Application Noteco
Page 13 and 14: Extreme Networks Application NoteSt
Page 31 and 32: Extreme Networks Application NoteTh
Page 35 and 36: Extreme Networks Application Note©
Page 39 and 40: Extreme Networks Application NoteDe
Page 55 and 56:
Extreme Networks Application NoteSt
Page 57 and 58:
Extreme Networks Application NoteSt
Page 59 and 60:
Extreme Networks Application Note<r
Page 61 and 62:
Extreme Networks Application Note<c
Page 63 and 64:
Extreme Networks Application NoteBe
Page 65 and 66:
Extreme Networks Application Note*
Page 67 and 68:
Extreme Networks Application NoteTo
show all

Deploying an Identity Aware Network

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?