Hp Procurve Access Control Client Software Security Solutions Acs_impl

2015-03-28

• Contents
• Introduction
  • Contents
  • Using This Guide
    • Network Access Control Solution 1
    • Network Access Control Solution 2
    • Network Access Control Solution 3
    • Network Access Control Solution 4
    • Network Access Control Solution 5
    • Summary of the Access Control Solutions
    • Hardware and Software Versions
• Implementing 802.1X with ProCurve IDM and Endpoint Integrity
  • Contents
  • Introduction
  • Configuring the ProCurve Switches
    • Routing Switches
    • Server Switch startup-config
    • Edge Switches
      • Wireless Services-Enabled Switch startup-config
  • Configuring the Windows Domain Controller
    • Install Windows Server 2003
    • Install Active Directory
    • Raise the Domain Functional Level
    • Configure Windows Domain Groups
    • Configure Windows Domain Users
    • Configure DNS Services
  • Configuring the DHCP Server
    • Install the DHCP Service
    • Configure the DHCP Server
  • Configuring Certificate Services
    • Join the Windows Server 2003 Server to the Domain
    • Install IIS and the Certificate Services
    • Set Up Autoenrollment of Computer and User Certificates
      • Set Up Autoenrollment of Computer Certificates
      • Create a Management Console for the CA
      • Customize the User Certificate Template
      • Create the NAC 800 Certificate Template
      • Deploy the New Certificate Templates to the CA
      • Set Up Autoenrollment of User Certificates
      • Export the CA Root Certificate
  • Configuring the Wireless Edge Services Modules
    • Install the Wireless Edge Services Modules
    • Configure Initial Settings on the Wireless Edge Services Modules
    • Configure WLAN Settings
    • Configure the Redundancy Group
    • Configure SNMP on the Wireless Edge Services Modules
    • Configure the Time
    • Set the Country Code
    • 802.1X Authentication for RPs
      • Configuring 802.1X Authentication for RPs
  • Configuring the NAC 800s
    • Install the NAC 800s
    • Configure Basic Settings on the NAC 800s
      • Configure Initial Settings Through a Console Session
      • Access the Web Browser Interface
      • Configure More Basic Settings for the MS
      • Create an Enforcement Cluster and Add ESs
    • Configure Quarantining
      • Add 802.1X Devices
    • Enable EAP-MD5 (Optional)
    • Configure Testing Methods
      • Configure Agentless Credentials
      • Enable the RPC Service on Endpoints
      • Select the Backup Testing Methods Suggested by the NAC 800
    • Configure NAC Policies
  • Manually Issue and Install Server Certificates
    • Create and Install a Certificate for the Wireless Edge Services Module’s HTTPS Server
      • Create a Certificate Request on the Wireless Edge Services Module
      • Submit the Request to the CA and Create the Certificate
    • Install the Certificate on a Wireless Edge Services Module
      • Enable the Certificate on the Wireless Edge Services Module’s HTTPS Server
    • Create and Install a Certificate for HTTPS on a NAC 800
      • Create a Certificate Request for HTTPS on a NAC 800
      • Submit the Request for the HTTPS Certificate to the CA
      • Install the Certificates for HTTPS on a NAC 800
    • Create and Install a Certificate for the NAC 800 RADIUS Service
      • Create a Certificate Request for the RADIUS Service
      • Submit the Request for the RADIUS Server Certificate to the CA
      • Install the Certificate for RADIUS Services on a NAC 800
  • Configuring Network Access Control with PCM+
    • Install PCM+
      • Install IDM 2.2
  • Configuring Network Access Control with IDM
    • Add NAC 800s to the Access.txt File
    • Enable Endpoint Integrity
    • Add Access Policy Groups and Users
    • Define Resources
    • Create Access Profiles
    • Configure Access Policy Groups
    • Deploy Policies to the NAC 800s
  • Setting Up Endpoints
    • Install Certificates
      • Autoenroll for Certificates
      • Manually Enroll for Certificates
    • Configure the 802.1X Supplicant
      • Configure the 802.1X Supplicant for EAP-TLS on an Ethernet Connection
      • Configure the 802.1X Supplicant for EAP-TLS on a Wireless Connection
      • Enable WZC
    • Pre-install the NAC EI Agent on Endpoints
      • Deploy the NAC EI Agent Automatically—Active Directory Group Policy Object Software Installation
  • Activating Network Access Control
    • Activate Port Authentication
    • Activate Quarantining
• Implementing 802.1X with Endpoint Integrity but without IDM
  • Contents
  • Introduction
  • Configure the ProCurve Switches
    • Routing Switches
    • Server Switch startup-config
    • Edge Switches
      • Wireless Services-Enabled Switch startup-config
  • Configure Windows 2003 Services
  • Configure IAS
    • Install IAS
    • Register IAS with Active Directory
    • Install a Certificate on the IAS Server
    • Configure IAS Properties
    • Configure the Remote Access Policies
      • Using the New Remote Access Policy Wizard
      • Manually Create a Remote Access Policy
      • Edit a Remote Access Policy
      • Optional Remote Access Policy for Network Administrators
    • Add RADIUS Clients
    • Enable Remote Access Logging
    • Install and Configure Connectors for Endpoint Integrity with the NAC 800
      • Install the Connector Files
      • Configure VLAN Assignments in the SAIASConnector.ini File
      • Edit the IAS Server Registry
    • Install the NAC 800’s CA Certificate as a Trusted Root on the IAS Server
  • Configure the Wireless Edge Services zl Modules
  • Configure the NAC 800s
    • Configure Basic Settings on the NAC 800s
      • Access the Web Browser Interface
    • Create the Enforcement Cluster and Add ESs
    • Configure Quarantining
      • Add 802.1X Devices
    • Configure NAC Policies
    • Configure Endpoint Integrity Testing Methods
    • Install SSL Certificates on the NAC 800s
    • Export a Self-signed Certificate from a NAC 800 and Install it on the IAS Server
  • Set Up Endpoints
  • Activate Network Access Control
• Implementing a VPN with Endpoint Integrity
  • Contents
  • Introduction
  • Configuring the ProCurve Switches
    • Routing Switch startup-config
  • Configure Windows Services
  • Configure Certificate Services
    • Customize a Template for VPN Client Certificates
      • Template for VPN Client Certificate Obtained Via a Manual Request
      • Template for a VPN Client Certificate with an Automatically Generated Subject Name
    • Customize the Template for the Router’s IPsec Certificate
    • Enable Templates on the CA Server
    • Export the CRL
    • Check the Key Size for the CA Root Certificate
  • Configure the ProCurve Secure Router 7000dl
    • Configure the Physical and Virtual Interfaces
      • Configure the Ethernet Interface
      • Configure the WAN Interface
    • Enable Telnet and SSH Access
    • Configure the Routing Protocol
    • Use Policy-Based Routing to Forward VPN Traffic Through the NAC 800
    • Enable Routing to the Remote Endpoints
      • Create the Route to the Remote Endpoints on the Secure Router 7000dl
      • Configure RIP Filters
    • Configure Network Address Translation (NAT)
      • Configure Source NAT
      • Configure Destination NAT with Port Forwarding
    • Establish the VPN
      • Activate Crypto Commands
      • Create a Client Configuration Pool
      • Configure an IKE Policy
      • Create ACLs for VPN Traffic
      • Configure a Transform Set
      • Create a Crypto Map
      • Create the Remote ID List
      • Apply the Crypto Map to an Interface
    • Allow VPN Traffic on the Internet Interface
    • Using Digital Certificates
      • Obtain Digital Certificates
      • Manage Certificates
    • Secure Router 7000dl Running-Config
  • Configuring the NAC 800
    • Install the NAC 800
    • Configure Initial Settings on the New NAC 800
      • Configure Initial Settings through a Console Session
    • Access the MS’s Web Browser Interface
    • Create the Enforcement Cluster
    • Add the ES to the Enforcement Cluster
      • Move an Existing ES to the New Cluster
    • Configure Quarantining
    • Set Up Accessible Services
    • Other Settings for the NAC 800
    • Activate Quarantining
  • Set Up Endpoints
    • Obtain a Certificate Using the Windows CA Web Enrollment Pages
    • Configure the ProCurve VPN Client
      • Obtain the ProCurve VPN Client
      • Install the ProCurve VPN Client
      • Install Certificates
      • Configure a New Connection
      • Create a Security Policy
      • Test the VPN Connection
      • Export the Policy and Certificates
    • User Instructions: Install the ProCurve VPN Client and the Preconfigured Policy
      • Import the Policy Manually
      • Manually Import Certificates
• Using the NAC 800 in a RADIUS-Only Configuration
  • Contents
  • Introduction
    • Configuring This Access Control Solution
    • Example—the Existing Network Environment
      • VLANs
      • DHCP and DNS Services
  • Switches
    • Concurrent Access Methods on the Same Port
      • Routing Switch Startup-Config
      • Server Switch Startup-Config
      • Edge Switch Startup-Configs
  • Configure the Wireless Edge Services Module
    • Configure Initial Settings on the Wireless Edge Services Modules
    • Configure WLAN Settings
      • Configure 802.1X as the Security for WLAN 1
      • Configure Web-Auth for WLANs 2 and 3
    • Copying Logo Files to the Module’s Flash
    • Configure SNMP on the Wireless Edge Services Modules
    • 802.1X Authentication for RPs
      • Configure 802.1X Authentication for RPs
  • Configure OpenLDAP
    • Extend the OpenLDAP Schema to Support RADIUS
      • Objects in the Standard OpenLDAP Schema
      • Create and Modify Files to Extend the Schema
      • RADIUS Objects
    • Create Objects in OpenLDAP
    • Bind to OpenLDAP
      • Base DN and Administrator
    • Configure a Root CA with OpenSSL
    • Create an Intermediate Certificate
    • Copy the Keys and Certificates to OpenLDAP
  • Configure the NAC 800 for a RADIUS- Only Deployment
    • Data Store Overview
    • Configuration Options
      • Initial Setup
      • Device Access
    • Specify the Quarantine Method (802.1X)
    • Configure Authentication to an OpenLDAP Server
    • Test Authentication Settings
    • Add NASs as 802.1X Devices
    • Apply Changes
    • Restart the RADIUS Server
    • Configure Exceptions
    • Configure Exceptions for the Cluster Default Settings
      • Configure Exceptions for a Particular Cluster
  • Configuring Network Access Control with IDM
    • Add NAC 800s to the Access.txt File
    • Import Users
      • Install the OpenLDAP Server’s CA Certificate on PCM+
      • Editing IDM Configuration for LDAP Import
    • Importing Users from an LDAP Server
      • Using Simple Authentication
      • Using Digest-MD5 Authentication
      • Using Kerberos-V5 Authentication
      • Using External Authentication
      • Using Anonymous Authentication
      • Extracting User and Group Information
    • Define Resources
    • Configure Locations
    • Configure Times
      • Configure Holidays
    • Create Access Profiles
    • Configure Access Policy Groups
    • Configure Access Policy Group Rules
  • Configure Endpoints
    • Configuring the Wireless Zero Configuration Utility for Wired Access
    • Configuring the Wireless Zero Configuration Utility for Wireless Access
    • Enable WZC
• Enforcing Endpoint Integrity without Port Authentication
  • Contents
  • Introduction
  • Network Layout
    • DHCP and DNS Services
  • Configure ProCurve Switches
    • Routing Switch startup-config
    • Server Switch startup-config
    • Edge Switch startup-config
  • Configure the AP 530 to Establish the Wireless Network
    • Configure Initial Settings
    • Establish the WLANs
    • Enable the Radios
  • Set Up the NAC 800
    • Configure Basic Settings and Install the NAC 800s
      • Install the NAC 800
      • Access the NAC 800 Web Browser Interface
    • Configure Quarantining
    • Configure Testing Methods
      • NAC EI Agent
      • ActiveX Testing Method
      • Select the Backup Testing Methods Suggested by the NAC 800
    • Configure NAC Policies
  • Prevent Users from Circumventing Endpoint Integrity Checking
    • DHCP Snooping
      • Enable DHCP Snooping
      • Configure Trusted Ports for DHCP Snooping
      • Define Authorized DHCP Servers
      • View DHCP Snooping Settings
    • ARP Protection
      • Enable ARP Protection
      • Configure Trusted Ports for ARP
      • Configure Static IP-to-MAC Address Bindings
      • View Information about ARP Protection
  • Set Up Endpoints
    • Pre-install the NAC EI Agent Manually
    • Open Ports on Non-Windows Firewalls
    • Configure the Wireless Zero Configuration Utility for Wireless Access
• Appendix A: Using IDM with eDirectory
  • Contents
  • Synchronize IDM and Novell eDirectory
    • Modify the IDMImportServerComp.scp File
    • Disable Active Directory Synchronization
    • Import eDirectory Users
      • Using SSL
      • Using Simple Authentication
      • Using Digest-MD5 Authentication
      • Using Kerberos-V5 Authentication
      • Using External Authentication
      • Using Anonymous Authentication
      • Importing X.509 User Certificates into a Keystore
• Appendix B: Glossary
  • Numeric
  • A
  • C
  • D
  • E
  • F
  • H
  • I
  • K
  • L
  • M
  • N
  • O
  • P
  • Q
  • R
  • S
  • T
  • U
  • V
  • W
  • X
• Addendum: ProCurve Access Control Solution 2.1 Update
  • Contents
  • Introduction
  • Configuring the Windows Domain Controller
    • Installing Windows Server 2008
    • Configure Initial Settings
      • Set the Time Zone
      • Set Static IP Settings
    • Install Active Directory
    • Configure Windows Domain Groups
    • Configure Windows Domain Users
    • Configure DNS Services
  • Configuring the DHCP Server
    • Install the DHCP Service
    • Configure the DHCP Server
  • Configuring Certificate Services
    • Join the Windows Server 2008 Server to the Domain
    • Install IIS and the Certificate Services
      • Export the CA Root Certificate
  • Configuring the NPS Server
    • Join the Server to the Domain
    • Install the NPS Server Role
    • Install the Group Policy Management Feature
    • Obtain a Computer Certificate on the NPS Server
    • Configure 802.1X NAP Enforcement Using the NAP Configuration Wizard
    • Verify NAP Policies
    • Configure System Health Validators (SHVs)
    • Configure NAP Client Settings in Group Policy
    • Configure Security Filters for the NAP Client Settings
  • Configuring the Wireless Edge Services Modules
    • Install the Wireless Edge Services Modules
    • Configure Initial Settings on the Wireless Edge Services Modules
    • Configure WLAN Settings
    • Configure SNMP on the Wireless Edge Services Modules
    • Change Web-User Passwords
    • Specify the Wireless Module’s DNS Server
    • Configure the Time
    • Set the Country Code
    • Obtain a Server Certificate for the Wireless Module
      • Create a Certificate Request on the Wireless Edge Services Module
      • Submit the Request to the CA and Create the Certificate
    • Install the Certificate on a Wireless Edge Services Module
      • Enable the Certificate on the Wireless Edge Services Module’s HTTPS Server
  • Configure the Endpoints
    • Enable Run on the Start Menu
    • Join the Windows Vista Computer to the Domain
    • Add the Windows Vista Computer to the NAP Client Computers Group
    • Verify Group Policy Settings
    • Configure Authentication Methods
      • Configure the Local Area Connection
      • Configure the Wireless Connection
  • Configuring Network Access Control with IDM
    • Install IDM
    • Add the NPS Server to the Access.txt File
    • Install the IDM Agent on the NPS Server
    • Verify That IDM Detects the NPS Server
    • Enable Endpoint Integrity
    • Add Access Policy Groups and Users
    • Define Network Resources
    • Create Access Profiles
    • Configure Access Policy Groups
    • Deploy Policies to the NPS Server
  • Guest Access for Wireless Users
    • Secure a WLAN with Web-Auth
      • Configure an IP Address on the Web-Auth VLAN
      • Enable Web-Auth on the WLAN
    • Configure the Wireless Module’s Internal RADIUS Server
      • Configure Initial RADIUS Settings
      • Configure a Guest Group
    • Manage Guest User Accounts with the Web-User Administrator
      • Create a Web-User Administrator Account
      • Add Guest Accounts as a Web-User Administrator
    • Configure an ACL for the Guest VLAN on the Routing Switch
• Index