User manual SOPHOS NAC ADVANCED 3.2 802.1 DYNAMIC VLAN ASSIGNMENT

[. . . ] 802. 1x Dynamic VLAN Assignment 802. 1x Dynamic VLAN Assignment Copyright 2009 Sophos Group. No part of this publication may be reproduced, stored in retrieval system, or transmitted, in any form or by any means electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner. All other product and company names are trademarks or registered trademarks of their respective owners. Document version 3. 2 Published October 2009 2 802. 1x Dynamic VLAN Assignment Table of Contents 802. 1x Dynamic VLAN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] If you have defined RADIUS Enforcer access templates, all templates of a particular compliance state are automatically applied to each access state; you can prioritize or delete them as necessary. Policy Mode RADIUS Report Only Endpoints are evaluated against profiles in policy and report information is generated in the Compliance Manager; however, no messages are displayed, no remediation actions are performed on the endpoint, and no enforcement actions are taken. Select a RADIUS Enforcer template that enables access for traffic originating from the endpoint. Important: If you apply a RADIUS Enforcer access template that prevents network access in the Report Only mode, all requests that match the selected template will be denied access regardless of their actual compliance state. To enforce a compliance state, you must change the policy mode to Enforce. Remediate Endpoints are evaluated against profiles in policy, report information is generated in the Compliance Manager, messages are displayed, and remediation actions are performed on the endpoint; however, no enforcement actions are taken. Select a RADIUS Enforcer access template that enables access for traffic originating from 14 Descriptions and Access States 802. 1x Dynamic VLAN Assignment Policy Mode Descriptions and Access States the endpoint. Important: If you apply a RADIUS Enforcer access template that prevents network access in the Remediate mode, all requests that match the selected template will be denied access regardless of their actual compliance state. To enforce a compliance state, you must change the policy mode to Enforce. Enforce Endpoints are evaluated against profiles in policy, report information is generated in the Compliance Manager, messages are displayed and remediation actions are performed on the endpoint, and access templates are enforced for the following access states. The selected RADIUS Enforcer access templates associated with each state in policy determine network access when the endpoint is in that state. Enforcer State: · Policy Retrieval Error: The user's compliance state is out-of-date according to the RADIUS Policy Update Threshold field configured in the Configure System > Enforcer Settings area. Compliant: The assessment determined the endpoint is compliant with the policy. Partially Compliant: The assessment determined the endpoint is partially compliant with the policy. Non-Compliant: The assessment determined the endpoint is not compliant with the policy. Compliance States: · · · 12. As necessary, use the arrows to prioritize RADIUS Enforcer access templates. If more than one template applies to a particular state, the first template that meets the state is used. Sophos recommends that you prioritize the more specific/strict access templates first and the less specific/strict access templates last. Click Save. 15 802. 1x Dynamic VLAN Assignment Microsoft Supplicant Settings (MD5-Challenge Protocol) To set up the Microsoft supplicant using MD5-Challenge protocol, use following procedure on Windows XP (SP1 and SP2) and Windows 2000 SP4. In the Network Connections window, double-click the local area connection that is connected to the switch. Note: If the Authentication tab does not appear in the Local Area Connection Properties window in Windows XP, verify that the Wireless Zero Configuration service is started and the startup type is set to Automatic. For Windows 2000 SP4, verify that the Wireless Configuration service is started and the startup type is set to Automatic. Select the Enable IEEE 802. 1x authentication for this network check box, and select MD5-Challenge from the EAP type list box. [. . . ] interface FastEthernet0/6 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive dot1x timeout reauthperiod 30 spanningtree portfast ! interface FastEthernet0/7 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive spanningtree portfast ! interface FastEthernet0/8 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive spanningtree portfast ! interface FastEthernet0/9 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive spanningtree portfast ! [. . . ]