思科统一无线网络设计和部署（下）.pptVIP

Wired IDS 4200 Series IDS Sensor 有线/无线 IDS/IPS 集成 Cisco Controller 2. Deep Packet Inspection 3. Shun 1. Malicious Traffic from Authenticated User ? Authorized user’s laptop infected with worm or virus ? ? IDS/IPS sensor monitors traffic with deep packet inspection (Layer 7) to identify and triggers shun event; WLAN controller shuns/blocks the MAC address of compromised wireless client Integration of wired and wireless security Solution Enterprise Network 1. Client to AP/Controller 2. Controller to IDS 3. Shun IDS to controller Problem CS-MARS ACSv4.0 与CS-MARS的集成 CS-MARS provides a centralized monitoring and reporting point for 802.1x-related events from ACS, NADs, and third party security servers pnAgent forwards logs from ACS to CS-MARS Pinpoints where identity events are occurring in the network, provides detailed logging information regarding events, and reports 802.1x Failed Authentications—Top Users Audit Server NADS pnAgent Posture Validation Server Syslog 内部网 / 网络 与端点准入应用的集成 目标 2. 用户被重导向到登录页面 Clean Access验证用户名和密 码，并执行设备和网络扫描。以 评估设备上的安全漏洞 3a. 设备不符合安全策略或登录信息不 正确 拒绝用户接入，向其分配一个隔离角 色，使其访问在线修复资源 隔离 3b. 设备已“清洁” 机器进入“认证设备列表”， 获得接入网络的许可 Clean Access Server Manager 1. 最终用户尝试访问某一网页或使用一个 可选客户端 在有线或无线最终用户提供登录信息之前，禁 止其接入网络 验证 服务器 Clean Access IEEE 802.11 Radio Summary 2.402–2.483 Worldwide Available 5.15–5.35, 5.47– 5.825 Limited Worldwide Availability Frequency Range (GHz) Status 1999 6, 9, 12, 18, 24, 36, 48, 54 Up to 19 in Certain Regulatory Domains 2003 1 ,2, 5.5, 11 and 6, 9, 12, 18, 24, 36, 48, 54 3 1999 1, 2, 5.5, 11 3 Ratified Data Rates (Mbps) Number of Non- Overlapping Channels 802.11a 802.11g 802.11b 无线连接速率, 覆盖和站点勘查 距离 AP越近，客户端获得的无 线连接速率越高 速率越高，蜂窝约小。 思科支持皮蜂窝技术（Pico Cell）来 支持高密度高带宽接入 AP蜂窝的大小取决于AP的发射 功率 覆盖采用全部发射功率来规划的设 计会极大减小射频管理的灵活性 天线的增益会影响蜂窝的大小 天线增益是用