Enterasys Networks 9034385 - Manual (Page 89)

Out-of-Band NAC Design Procedures
Enterasys NAC Design Guide 5-25
previously specified in the NAC configuration must be defined in NetSight Policy Manager to
ensure the consistent allocation of network resources to connecting end‐systems.
Failsafe Policy and Accept Policy Configuration
The Failsafe Policy is assigned to end‐systems when an error occurs in the NAC process. An error
state results if the end‐systemʹs IP address could not be determined from its MAC address, or if
there was an assessment error and an assessment of the end‐system could not take place.
For Enterasys policy‐enabled switches, a corresponding policy role (created in Policy Manager)
should allocate a nonrestrictive set of network resources to the connecting end‐system so it can
continue its connectivity on the network, even though an error occurred in the NAC process.
The Accept Policy is assigned to an end‐system when it has been authorized locally by the NAC
Gateway and when an end‐system has passed an assessment (if an assessment was required), or if
the Accept Policy has been configured to replace the Filter‐ID information returned in the
RADIUS authentication messages.
For Enterasys policy‐enabled switches, a corresponding policy role (created in Policy Manager)
would allocate the appropriate set of network resources for the end‐system depending on their
role in the enterprise. For example, you might associate the Accept Policy to the “Enterprise User”
role that is defined in the NetSight Policy Manager demo.pmd file.
Assessment Policy and Quarantine Policy Configuration
The Assessment Policy and Quarantine Policy are used when end‐system assessment is
implemented in the NAC deployment. The policy roles shown in the Policy Manager window
below correspond to the access policies used in NAC Manager. For example, the Assessing Policy
role in Policy Manager corresponds to the Assessment Policy in NAC Manager. Note that the
Administrator, Enterprise User, Enterprise Access, and Guest Access policy roles are also defined
in the Policy Manager demo.pmd file.