Five Crucial Steps To Deploying A Secure Guest Network-PDF Free Download

Transcription

Cisco Mobility TV, Mobility TV Host Brian Uffelman. Chris Kozup Product Manager, Senior Manager Wireless Networking BU. Mobility Solutions Cisco, 2008 Cisco Systems Inc All rights reserved Cisco Public 2. 1 Guest Access Business Drivers, 2 Network Segmentation. 3 User Policy Management, 4 Guest User Provisioning.
5 Login Portal, 6 Reporting and Billing, 7 Cisco Guest Access Solutions. 2008 Cisco Systems Inc All rights reserved Cisco Public 3. Drivers for Guest Network Access, Providing a Positive Balancing the Needs of Guest Streamlining IT. Users and IT Departments, Visitor Experience Mgmt and Control. Visitor Access Network Integrity, for VPN and Security. Internet Access, for Customers, Customized, Contractor Secured.
Internal Network, Access Simplified, Network Design. On Site Vendor, Cost Effective, Segmenting Deployment and. Visitors from Operations, Subsidiaries, 2008 Cisco Systems Inc All rights reserved Cisco Public 4. The Challenge of the Guest User, Data Center, Internal Network. Visitor Internet, Contractor etc, Guest traffic should be segmented from the internal network.
Limited internal network access must be extended to guest. Guest network must be cost effective and non disruptive. Must not require guest desktop software or configuration. 2008 Cisco Systems Inc All rights reserved Cisco Public 5. Types of Network Users, Corporate Contractors Guests. Employees Consultants Users, Need internal Need restricted Internet access. network access internal access only, Can be role based Printers No need to access. to allow granular internal systems, access if needs File shares. Segment access, require Specific completely, applications.
Device support, Full Internet, Cisco Guest Access Gives You Control. Access Only, 2008 Cisco Systems Inc All rights reserved Cisco Public 6. Guest Access Solution Entities, Access Network Guest Lifecycle. Enforcement Management, Secure NAC NAC Guest, Catalyst Appliance Server. Wireless Cisco, Controller, 2008 Cisco Systems Inc All rights reserved Cisco Public 7.
Components of a Guest Access Solution, Network Segmentation IT Admin Function. User Policy Management IT Admin Function, Guest User Provisioning Employee Function. Login Portal Guest User Function, Reporting Billing IT Admin Function. 2008 Cisco Systems Inc All rights reserved Cisco Public 8. Network Network, Segmentation, User Policy, Management. Guest User, Provisioning, Login Portal, Segmentation.
Goal Ensure security by segmenting guest traffic from the internal. network out to the Internet DMZ unsecured edge, Requirement Ease of network design configuration and operation. Compatibility with existing network architecture, Architectural Flexibility to Ease Deployment and Operations. VLANs Tunneling Ethernet over IP, Use of a 802 1Q trunk for switch Provides tunneling encapsulation. to AP connection to carry all the of traffic between WLAN Controllers. defined VLANs one VLAN out to Internet DMZ edge, Can carry traffic for all guest SSIDs. VLAN isolation ceases if there in single tunnel simplifies configuration. is a Layer 3 hop between WLAN and network architecture. Controller Internet edge, Can traverse Layer 3 networks.
simplifies network design, 2008 Cisco Systems Inc All rights reserved Cisco Public 9. Network Segmentation, Ethernet over IP Tunneling, EoIP tunnels logically segment Internet Guest WLAN. and transport guest traffic WCS Controller Anchor, between access layer and. Internet edge, Original guest s Ethernet frame EtherIP EtherIP. maintained across LWAPP and Guest, Tunnel Tunnel, EoIP tunnels Campus.
Eliminates need for guest VLANs, across network Emp. EoIP supported on all Cisco, WLAN Controllers, Catalyst Wireless Services Module. LWAPP LWAPP, Cisco 4400 Series, Cisco 3750 Series SSIDs. Cisco 2100 Series tunnel origination, only no termination Guest Emp Guest Emp. Cisco ISR WLAN Controller Module, 2008 Cisco Systems Inc All rights reserved Cisco Public 10.
Enhancing Cisco Unified Wireless, Guest Access with NAC. Increased Flexibility, NAC Appliance, Dynamically provisioned wired guest ports. Wired ports can be provisioned as guest ports at Interne. the time the guest logs in no pre provisioning of t VLAN. wired guest ports required WCS, Improves network scalability Controller. Centralizing authentication posture assessment and Si. remediation provides easier visibility to the network Campus. administrator Core, Improved Policies Emp, Provides new policy options. Integration with broader AAA LDAP AD, LWAPP LWAPP, Granular access control.
Bandwidth policies VLANs, Added security benefits Guest Emp Guest Emp. Network privileges based on user roles groups, End user security posture assessment restriction. and remediation, 2008 Cisco Systems Inc All rights reserved Cisco Public 11. Considerations Network, Segmentation, User Policy, Management. Guest User, Provisioning, Login Portal, for Guest User.
Policy Management, What type of Guest Access is Required. Unified Wired and Wireless, What are the bandwidth policies for different types. How are large numbers of guests provisioned, 2008 Cisco Systems Inc All rights reserved Cisco Public 12. Comprehensive User Policy Management, Provision Guest Network Access based. on when network usage is required, Time Of Day Access.
Provides granular control over when, guests can access network. Easily deployable universal wired or, wireless guest access. Technology Specific, Deploying appropriate access per site. location or network user population, Extend network access based on the. specific user or group, Per User Role, Granular role based access enhances.
network security, 2008 Cisco Systems Inc All rights reserved Cisco Public 13. Guest Network Bandwidth, Policy Controls, Controller Requirements. Specify bandwidth limitations, and policies by individual user. Allocate resources by specific, job function or throughput. requirements, LWAPP LWAPP, Guest Emp Guest Emp, SSID Acct SSID Contractor.
Organization s overall network, performance is enhanced. Increased granularity and control, improves network security. Accounting Network Admin, Contractor Contractor, Best Effort 4Mbps High Speed. 2008 Cisco Systems Inc All rights reserved Cisco Public 14. Guest User Provisioning Enhancements, Considerations Features. Guest Provisioning Templates Configure guests using pre configured provisioning. Bulk Guest User Provisioning Providing the ability to configure multiple guest. users at once, Business Benefits, Streamlines guest access provisioning.
Single click guest provisioning reduces errors made by provisioning personnel. Templates are defined and uploaded by the network administrator. No network knowledge required to provision guests when locked down templates. are in place, Reduces time required to provision multiple groups of users Bulk provisioning. of multiple, 2008 Cisco Systems Inc All rights reserved Cisco Public 15. 2008 Cisco Systems Inc All rights reserved Cisco Public 1 Five Crucial Steps to Deploying a Secure Guest Network Cisco Mobility TV