Enterasys brings policy enforcement closer to users

ROCHESTER, N.H. - Enterasys Networks this week will announce software aimed at simplifying the creation of user access and security policies while putting the enforcement of access rules on network access points.

The NetSight Policy Manager will let users with Enterasys' Matrix wiring closet switches push LAN security enforcement from back-end servers up to the network/client connection point in wiring closets, the company says. This can help improve security by controlling authentication at the switch level instead of deeper into the network at the server.

The software is intended to let network managers tie together server and application access rights as well as network quality of service and virtual LAN (VLAN) assignments according to business departments or predefined classes of users. It works in concert with Matrix switches, network directory servers and Remote Authentication Dial-In User Service (RADIUS) servers. These combined elements form what the company calls its User Personalized Network (UPN).

"Policy management is something that could be improved on our network," says James Labonte, network engineer for St. John's Hospital in Springfield, Ill., who is beta-testing the NetSight Policy Manager.

"Normally, we'd have to go port by port, down to the IP level of what an application is using to enforce policy," Labonte says. He anticipates that the new software will let him enforce policy at the switch level without having to spend time configuring his hardware.

According to the UPN model, when users log on, the access request is processed by back-end RADIUS and directory servers such as Novell Directory Services or Microsoft Active Directory. If access is granted, the switch interprets the user's network identity and job role from the back-end directory and applies business policies to the user, interpreted as what VLAN the user is part of, what network resources the user can reach and at what rate. The switch is made aware of the policies from the Windows-based NetSight Policy Manager.

Controlling access at the wiring closet is key for reducing internal security breaches, says Steve Pettit, technical director at Enterasys.

In networks where access depends solely on server logons, "someone trying to gain access to [enterprise resources] can still talk on the network even if they fail to authenticate to a server," Pettit says. "They can still use printers and get on the Internet and send packets over the network."

NetSight Policy Manager is available and costs $5,000. Enterasys Matrix E7 and E5 wiring closet switches are also available and cost about $20,000 and $11,000, respectively.

Enterasys Networks: www.enterasys.com