Filter
Top Products
20 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems
tables that contain data gathered by the collectors. In a generic Security
Compliance Manager deployment, the compliance queries are evaluated on the
server, but with NAC-enabled clients using new posture collectors they can also
be evaluated on the client. A compliance query is written to return a list of policy
violations.
The results of the compliance queries associated with a particular policy can be
used on the Security Compliance Manager server to provide a current picture, or
snapshot, of the level of compliance for all clients in a client group. The results of
the compliance queries evaluated locally on the client are passed as a posture
status. They define the client’s compliance status.
Compliance User Interface
When a client is found to be out of compliance, the Tivoli Security Compliance
Manager Client opens a window that notifies the user of the violation and
provides a means to invoke the remediation process. This user interface includes
a functional Web browser that supports customized HTML content that can assist
the user in remediating. In addition, if an automated remediation handler is
installed, a button to start automated remediation is presented to the user.
Remediation handler
A remediation handler performs the functions of communicating with the
remediation server to download remediation content, installing downloaded
content and providing respective notification to the user.
Network Admission Control process
The following are the conceptual steps of the Network Admission Control
process. Figure 2-3 on page 21 displays the result of what happens to compliant,
noncompliant, and clientless devices.
A user tries to connect (remotely or locally) to the corporate network.
A Network Access Device (NAD) challenges the client for compliance posture
information.
The Security Compliance Manager policy-enabled
client communicates with
the NAC system.
The NAC system
validates the client’s health (posture) based on predefined
rules.
The NAC system either admits the client to the network if it complies with all
of the policies or quarantines the client, allowing access only to a remediation
network if the client is not complying with the policies.