Enterasys Networks 9034385 - Manual (Page 43)

Scenario 2: Intelligent Wireless Access Edge
Enterasys NAC Design Guide 3-5
intelligent edge on the network. The Matrix N‐series switch is capable of authenticating and
authorizing multiple devices connected to a single port for a variety of network topologies,
ranging from an IP phone cascaded with a PC on a single Matrix N‐series port, to a stack of non‐
intelligent edge switches uplinked to a single Matrix N‐series port where over 1000 end‐systems
connect. In this configuration, the Matrix N‐series acts as the intelligent edge switch on the
network, although not physically located at the access edge. Each individual end‐system is
authenticated using 802.1X, web‐based, and/or MAC authentication and is subsequently
authorized on the Matrix N‐series inter‐switch link to the access edge. By provisioning access to
network resources on the Matrix N‐series using MUA, end‐system traffic destined to adjacent
switches on the network can be securely contained with policy at the Matrix N‐series port.
Scenario 2: Intelligent Wireless Access Edge
In the intelligent wireless access edge use scenario, thick Access Points (APs) or wireless switches
with thin APs provide authentication and authorization for connecting end‐systems.
For this use scenario, the NAC Gateway appliance is deployed for out‐of‐band network access,
leveraging the intelligent wireless infrastructure devices as the authorization point for connecting
end‐systems.
Thin Wireless Edge
In a thin wireless deployment, wireless switches tunnel wireless end‐system traffic to and from
access points deployed on the network. Most thin wireless deployments are categorized under the
intelligent wireless access edge use scenario because the wireless switches are capable of
providing authentication (802.1x, web‐based, or MAC) and are also capable of being an
authorization point either through dynamic VLAN assignment as specified in RFC 3580 or
application of user‐based ACLs or policy.
The following figure illustrates how the NAC Gateway and the other Enterasys NAC components
work together in a thin wireless deployment.