Chapter 5. Solution design
115
SVIs. Each Shared RADIUS Authorization Component had a corresponding ACL
defined on the NAD. The example below shows the configuration used for the
Healthy Engineering VLAN and the Quarantine Sales VLAN.
access-list 120 remark **Healthy Engineering VLAN ACLs**
access-list 120 deny ip any 192.168.13.0 0.0.0.255
access-list 120 deny ip any 192.168.14.0 0.0.0.255
access-list 120 deny ip any 192.168.15.0 0.0.0.255
access-list 120 permit ip any any
!
access-list 130 remark **Quarantine Sales VLAN ACLs**
access-list 130 permit icmp any host 192.168.9.220
access-list 130 permit icmp any host 192.168.104.10
access-list 130 permit ip any host 192.168.9.220
access-list 130 permit ip any host 192.168.104.10
access-list 130 permit udp any eq bootpc any eq bootps
access-list 130 deny ip any 192.168.11.0 0.0.0.255
access-list 130 deny ip any 192.168.12.0 0.0.0.255
access-list 130 deny ip any 192.168.14.0 0.0.0.255
access-list 130 deny ip any 192.168.15.0 0.0.0.255
access-list 130 permit tcp any any eq www
access-list 130 permit tcp any any eq domain
access-list 130 deny ip any any log
!
Note that the Healthy Engineering VLAN ACL has three deny entries before the
permit statement. This is to stop any member of this VLAN trying to initiate any
connections to any of the Quarantine VLANs, as an added security measure.
Similarly, note that the Quarantine Sales VLAN ACL allows the Security
Compliance Manager and Tivoli Configuration Manager to be pinged, as a check
for network connectivity, and also allows IP access to just the Security
Compliance Manager and Tivoli Configuration Manager. This is for receiving an
updated policy and other automated remediation tasks.
Performing remediation
Now that the Security Compliance Manager and ACS policies have been
configured, the next step is to prepare the appropriate remediation workflows.
The operations team based on the names of the workflows assigned during
policy creation have to design and deploy the set of software package blocks also
known as remediation packages or workflows on Tivoli Configuration Manager
server. These steps require the remediation server to be installed and
operational. Detailed procedures for setting up the remediation server are
described in Chapter 8, “Remediation subsystem implementation” on page 355.
Summary of Contents for Tivoli and Cisco
Page 2: ......
Page 16: ...xiv Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 18: ...xvi Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 20: ...2 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 30: ...12 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 56: ...38 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 94: ...76 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 110: ...92 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 142: ...124 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 225: ...Chapter 6 Compliance subsystem implementation 207 Figure 6 77 Client connection window...
Page 456: ...438 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 458: ...440 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 504: ...486 Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 513: ...Building a Network Access Control Solution with IBM Tivoli and Cisco Systems...
Page 514: ......
Page 515: ......
