User manual SOPHOS NAC ADVANCED 3.2 802.1 DYNAMIC VLAN ASSIGNMENT

[. . . ] 802. 1x Dynamic VLAN Assignment 802. 1x Dynamic VLAN Assignment Copyright 2009 Sophos Group. No part of this publication may be reproduced, stored in retrieval system, or transmitted, in any form or by any means electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner. All other product and company names are trademarks or registered trademarks of their respective owners. Document version 3. 2 Published October 2009 2 802. 1x Dynamic VLAN Assignment Table of Contents 802. 1x Dynamic VLAN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] If you selected any application or patch profiles, you can specify the operating systems on which the application or patch will be evaluated. Also, if you selected more than one application profile, you can prioritize the applications for evaluation. 11. In the left navigation Network Access area, click the RADIUS enforcement type. To add access templates for a particular access state, click the appropriate policy mode tab, click Select, select the option button or check boxes beside the access templates and beside the access states that the templates apply to, and click OK. You can also leave or delete the current access templates. The following policy modes and access states are available: Note: By default, each policy is automatically populated with access templates for each of the access states, based on the templates defined in the Compliance Manager and their associated template compliance states. If you have defined RADIUS Enforcer access templates, all templates of a particular compliance state are automatically applied to each access state; you can prioritize or delete them as necessary. Policy Mode RADIUS Report Only Endpoints are evaluated against profiles in policy and report information is generated in the Compliance Manager; however, no messages are displayed, no remediation actions are performed on the endpoint, and no enforcement actions are taken. Select a RADIUS Enforcer template that enables access for traffic originating from the endpoint. Important: If you apply a RADIUS Enforcer access template that prevents network access in the Report Only mode, all requests that match the selected template will be denied access regardless of their actual compliance state. To enforce a compliance state, you must change the policy mode to Enforce. Remediate Endpoints are evaluated against profiles in policy, report information is generated in the Compliance Manager, messages are displayed, and remediation actions are performed on the endpoint; however, no enforcement actions are taken. Select a RADIUS Enforcer access template that enables access for traffic originating from 14 Descriptions and Access States 802. 1x Dynamic VLAN Assignment Policy Mode Descriptions and Access States the endpoint. Important: If you apply a RADIUS Enforcer access template that prevents network access in the Remediate mode, all requests that match the selected template will be denied access regardless of their actual compliance state. To enforce a compliance state, you must change the policy mode to Enforce. Enforce Endpoints are evaluated against profiles in policy, report information is generated in the Compliance Manager, messages are displayed and remediation actions are performed on the endpoint, and access templates are enforced for the following access states. The selected RADIUS Enforcer access templates associated with each state in policy determine network access when the endpoint is in that state. Enforcer State: · Policy Retrieval Error: The user's compliance state is out-of-date according to the RADIUS Policy Update Threshold field configured in the Configure System > Enforcer Settings area. Compliant: The assessment determined the endpoint is compliant with the policy. Partially Compliant: The assessment determined the endpoint is partially compliant with the policy. Non-Compliant: The assessment determined the endpoint is not compliant with the policy. Compliance States: · · · 12. As necessary, use the arrows to prioritize RADIUS Enforcer access templates. If more than one template applies to a particular state, the first template that meets the state is used. [. . . ] interface FastEthernet0/7 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive spanningtree portfast ! interface FastEthernet0/8 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive spanningtree portfast ! interface FastEthernet0/9 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive spanningtree portfast ! interface FastEthernet0/10 switchport access vlan 102 switchport voice vlan 100 no logging event linkstatus no keepalive spanningtree portfast ! [. . . ]