Filter
Top Products
Chapter 5. Solution design 115
SVIs. Each Shared RADIUS Authorization Component had a corresponding ACL
defined on the NAD. The example below shows the configuration used for the
Healthy Engineering VLAN and the Quarantine Sales VLAN.
access-list 120 remark **Healthy Engineering VLAN ACLs**
access-list 120 deny ip any 192.168.13.0 0.0.0.255
access-list 120 deny ip any 192.168.14.0 0.0.0.255
access-list 120 deny ip any 192.168.15.0 0.0.0.255
access-list 120 permit ip any any
!
access-list 130 remark **Quarantine Sales VLAN ACLs**
access-list 130 permit icmp any host 192.168.9.220
access-list 130 permit icmp any host 192.168.104.10
access-list 130 permit ip any host 192.168.9.220
access-list 130 permit ip any host 192.168.104.10
access-list 130 permit udp any eq bootpc any eq bootps
access-list 130 deny ip any 192.168.11.0 0.0.0.255
access-list 130 deny ip any 192.168.12.0 0.0.0.255
access-list 130 deny ip any 192.168.14.0 0.0.0.255
access-list 130 deny ip any 192.168.15.0 0.0.0.255
access-list 130 permit tcp any any eq www
access-list 130 permit tcp any any eq domain
access-list 130 deny ip any any log
!
Note that the Healthy Engineering VLAN ACL has three deny entries before the
permit statement. This is to stop any member of this VLAN trying to initiate any
connections to any of the Quarantine VLANs, as an added security measure.
Similarly, note that the Quarantine Sales VLAN ACL allows the Security
Compliance Manager and Tivoli Configuration Manager to be pinged, as a check
for network connectivity, and also allows IP access to just the Security
Compliance Manager and Tivoli Configuration Manager. This is for receiving an
updated policy and other automated remediation tasks.
Performing remediation
Now that the Security Compliance Manager and ACS policies have been
configured, the next step is to prepare the appropriate remediation workflows.
The operations team based on the names of the workflows assigned during
policy creation have to design and deploy the set of software package blocks also
known as remediation packages or workflows on Tivoli Configuration Manager
server. These steps require the remediation server to be installed and
operational. Detailed procedures for setting up the remediation server are
described in Chapter 8, “Remediation subsystem implementation” on page 355.