Access Control Design

NAC Server Selection

In the centralized gateway solution, iMaster NCE-Campus delivers service configurations to campus network devices and implements automatic network deployment. iMaster NCE-Campus can also function as a NAC server, removing the need to deploy an additional NAC server for network access control. When iMaster NCE-Campus functions as a NAC server, it provides the following access control functions:

• Built-in RADIUS server and Portal server components: These components support 802.1X authentication, Portal authentication, MAC address authentication, and MAC address-prioritized Portal authentication.
• Multiple Portal authentication modes: Portal authentication supports user name and password authentication, SMS authentication, and third-party social media authentication.
• Terminal identification: iMaster NCE-Campus can implement automatic MAC address authentication based on terminal identification.
• Free mobility: iMaster NCE-Campus can deliver security group policies to the policy enforcement point, removing the need to configure security group policies on the policy enforcement point. iMaster NCE-Campus can also function as a RADIUS server and allows administrators to specify security group information when configuring authorization results.

Authentication Control Point Selection

In the centralized gateway solution, the authentication control point is deployed as follows:

• It is recommended that the authentication control point for wired user access be deployed on the edge node. When configuring access management for a fabric, you need to configure the authentication control point for wired user access. For details, see "Access Management Design" in Fabric Network Design.
• The authentication control point for wireless user access is deployed on the WAC. For details about the planning and design of the authentication control point for wireless user access, see "WLAN Admission Design" in WLAN Design.

In the centralized gateway solution, you are advised to deploy a VXLAN across core and access layers for fabric networking. If the VXLAN is deployed across core and aggregation layers (for example, in the device reuse and reconstruction scenario), policy association can be deployed between an aggregation switch (functioning as an edge node) and access switch.

• The edge node functions as the authentication control point to authenticate users and control access switches on executing user access policies.
• The access switch functions as the authentication enforcement point to control user access. Users can access the network only after being authenticated successfully.

Authentication Enforcement Point Selection

In the centralized gateway solution, the authentication enforcement point is deployed as follows:

• It is recommended that the wired authentication enforcement point be deployed on an access switch on the campus network so that the access switch can control access of wired user terminals. In the centralized gateway solution, you are advised to deploy a VXLAN across core and access layers for fabric networking. In this way, the edge node can function as both the authentication control point and authentication enforcement point. In a few network device reuse scenarios, the VXLAN is deployed across core and aggregation layers, and an aggregation switch functions as the edge node. In this deployment mode, policy association can be deployed between the edge node and access switch. In this way, the wired authentication control point does not need to be moved down from the edge node to the access switch, the number of wired authentication control points does not increase, and the wired authentication enforcement point that controls access of wired user terminals still sits on the access switch.
• Policy association is designed based on the traditional "WAC + Fit AP" architecture for access control. In this architecture, WACs function as wireless authentication control points and APs as wireless authentication enforcement points. Wireless user authentication information is synchronized between WACs and APs through CAPWAP tunnels. The AP prevents unauthorized users from accessing the campus network.

Policy Enforcement Point Selection

In the centralized gateway solution, the policy enforcement point is deployed as follows:

• It is recommended that the edge node be configured as both the wired authentication control point and wired policy enforcement point to deploy security group policies for free mobility. iMaster NCE-Campus can dynamically generate IP-security group entries and deliver the entries to the edge node based on the security group information configured in the authorization result of wired users. The edge node then enforces security group policies for authorized wired users based on the IP-security group entries.

  On a traditional non-virtualized network where multiple authentication control points exist, configure IP-security group entry subscription to synchronize IP-security group entry information between different authentication control points. This ensures that the authentication control points can implement access control based on security group policies across authentication control points when they function as policy enforcement points. On a virtualized network, you do not need to configure IP-security group entry subscription because the VXLAN header encapsulated in user packets carries security group information when user packets are forwarded across authentication control points.

• It is recommended that the border node be used as the wireless policy enforcement point for deploying security group policies for free mobility.
  • In the recommended networking where the border node functions as the native WAC, you should configure the border node as both the wireless authentication control point and wireless policy enforcement point for deploying security group policies for free mobility. iMaster NCE-Campus can dynamically generate IP-security group entries and deliver the entries to the border node based on the security group information configured in the authorization result of wireless users. The border node then enforces security group policies for authorized wireless users based on the IP-security group entries.
  • In device reuse scenarios, if the existing WAC does not support the free mobility function, the border node to which the WAC connects in off-path mode can be used as the wireless policy enforcement point for deploying security group policies for free mobility. When the border node functions as the wireless policy enforcement point, it is not a wireless authentication control point and cannot obtain IP-security group entry information through user authentication and authorization. Therefore, you need to enable IP-security group entry subscription on the border node.

Traditional NAC Solution Design

In the traditional NAC solution, policies fall into two categories: static ACL policies on local devices and dynamic ACL policies authorized by the NAC server. Essentially, configuring static ACL policies on local devices is to map user policies to user IP addresses and plan ACL rules based on these IP addresses for management and control over user permissions. This type of policy applies to the scenario where the user network scale is small, locations of user terminals are fixed, and policy requirements are simple. As the network scale increases and policy requirements become complex, configuring such policies can be very complex and difficult to maintain. Therefore, for large- and medium-sized campus networks, you are advised to use the NAC server to authorize dynamic ACL policies. With this approach, terminals do not need to be strictly bound to IP addresses and VLANs, making IP and VLAN planning flexible, as shown in Figure 2-57. When different types of users are present, you are advised to restrict access locations of the users. That is, users with different permissions access the Internet from their respective areas specified by the administrator. This ensures that only related policies need to be configured on devices in these areas. Otherwise, it will be difficult to configure policies and perform O&M.

Figure 2-57 Policy control based on the traditional NAC solution

Free Mobility Solution Design

Different from the traditional IP address-based ACL mode, free mobility is a user language-based solution that logically divides different types of network objects with distinct permissions into different security groups. Each security group maps one user type and one server type. Then, you can define policies for users in different security groups to communicate for access control, as shown in Figure 2-58.

Figure 2-58 Policy control based on the free mobility solution

iMaster NCE-Campus provides an intuitive policy matrix to allow the administrator to configure security group policies and deliver the policies to policy control points. Assume that A and C are user groups, and B and D are server groups. Members in group A can communicate with those in groups C and D, while members in group C can only communicate with those in group D. Members of group A or group C can communicate within their groups. The corresponding policy design is shown in Table 2-28. The communication between B and D does not pass through the campus network and does not need to be planned. In this case, the policy design between B and D is displayed as NA in the following table. In cells filled with Empty, no policy is configured, or the permit/deny policy is configured, which does not influence the control effect.

iMaster NCE-Campus allows administrators to configure a rule from a group to the Any group (that is, default permissions of the group), reducing the number of policies that need to be defined and thereby simplifying policy configuration. For example, as described in Table 2-28, an administrator simply needs to configure a policy for denying access from group A to group B so that access from group A to the Any group is permitted.