* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download guest management - Washington Learning Source
Survey
Document related concepts
Computer network wikipedia , lookup
SIP extensions for the IP Multimedia Subsystem wikipedia , lookup
Extensible Authentication Protocol wikipedia , lookup
Network tap wikipedia , lookup
Policies promoting wireless broadband in the United States wikipedia , lookup
Airborne Networking wikipedia , lookup
TV Everywhere wikipedia , lookup
Zero-configuration networking wikipedia , lookup
Distributed firewall wikipedia , lookup
List of wireless community networks by region wikipedia , lookup
Wireless security wikipedia , lookup
Transcript
The challenge and solution for BYOD Bruce Lurie, Territory Sales Manager Meru Confidential The Direction of Education 2 PROPRIETARY AND CONFIDENTIAL > Users want to connect more than just PC’s > Both Institution and Personally Owned Devices Diversity of Devices WI-FI NETWORK ACCESS IS CHANGING… Mission Critical WLAN for Casual Use Diversity of Users > Collaboration requires access for 3 PROPRIETARY AND CONFIDENTIAL • Employees • Students • Guests • Consultants …AND WITH IT BRINGS NEW IT CHALLENGES 1. How Do You Provision Secure Network Access For Bring Your Own Device (BYOD) • Under IT policies/control • Efficient / Cost-effective • Reduce reliance on IT 2. How Do You Provision Secure Network Access For New Types of User 4 • Efficiently - requiring no IT interaction • Flexibly – Get users on the network quickly • Traceable – Be able to fully audit network use PROPRIETARY AND CONFIDENTIAL INTRODUCING IDENTITY MANAGER – SOLVING THE KEY PROBLEMS > Guest Management • Delivers secure, scalable wireless network access for guests, employees and their mobile devices. • Less reliance on IT while enforcing the policies set forth by IT > Smart Connect • Solves the greatest to barrier to secure connectivity adoption • Provision client devices for secure 802.1x based on predetermined IT policy > Guest Management + Smart Connect • Addresses BYOD (Bring Your Own Device) for IT 5 PROPRIETARY AND CONFIDENTIAL GUEST MANAGEMENT 6 PROPRIETARY AND CONFIDENTIAL THE GUEST NETWORK – ENTERPRISE & PUBLIC HOTSPOTS A Guest Network is used to provide network access for external users > Enable improved productivity from suppliers and contractors > Strengthen collaboration between faculty and students > Becoming critical in education conferences > Presents a professional image to visitors and customers 7 PROPRIETARY AND CONFIDENTIAL THE CHALLENGES OF DEPLOYING A GUEST NETWORK > How do you: > Easily create user accounts? > Provide the details to your guests? > Give different levels of access? > Audit and Record everything that happens? > Meet your security requirements? 8 PROPRIETARY AND CONFIDENTIAL INTRODUCING GUEST MANAGEMENT WITH IDENTITY MANAGER 9 PROPRIETARY AND CONFIDENTIAL PROVISIONING > Who should create user accounts? • Receptionist/Lobby Ambassador • IT Security • Managers • Help Desk • Anyone > Identity Manager lets you choose based upon your security policy > Allowing anyone to create accounts provides increased usage and will be just as secure 10 Reduced Cost Full Audit Trail PROPRIETARY AND CONFIDENTIAL Speed of access Ease of use PROVISIONING USING THE SPONSOR PORTAL > Policy Based Sponsor Portal for internal users > Full Web or Smartphone Sponsor Interface available > Authenticate with corporate credentials • Local Database • Active Directory • LDAP • RADIUS • Kerberos • Client Certificates 11 PROPRIETARY AND CONFIDENTIAL CREATING GUEST ACCOUNTS 1. Enter user details 2. Specify the account length 3. Add user 12 PROPRIETARY AND CONFIDENTIAL NOTIFYING GUESTS Send account information via print-out, email, or SMS text message 13 PROPRIETARY AND CONFIDENTIAL CUSTOMIZABLE GUEST PORTALS Login Welcome to our guest hotspot! Credit Card Guest Self Registration 14 PROPRIETARY AND CONFIDENTIAL Password Change Fully customize this page and add the components you want! POLICY BASED GUEST PORTALS > Dynamically generate guest portal based upon your policy using: Location Language Device 15 IP Address Time of Day OS PROPRIETARY AND CONFIDENTIAL Cookies Web Browser Mobile Device HTTP Header GET Parameter POST Parameter MANAGEMENT AND REPORTING Visibility and Management of Guest Users 16 Sponsor Information PROPRIETARY AND CONFIDENTIAL Guest Information Account Management GUEST ACTIVITY REPORTING Internet Username: guestname IP Address: 192.168.1.1 Login Time: 11:30 Logout Time: 12:15 17 11:37 192.168.1.1 accessed http://www.google.com 11:38 192.168.1.1 used the bittorrent protocol 12:09 192.168.1.1 connected to vpn.mycompany.com Consolidated Audit Report of Guest Activity PROPRIETARY AND CONFIDENTIAL COMPLETE AUDIT OF GUEST ACTIVITY > When they logged in > Where they logged in > The guests address > What they did > What was allowed > What was disallowed 18 PROPRIETARY AND CONFIDENTIAL MANAGEMENT REPORTS FULL CUSTOMIZED MANAGEMENT REPORTING OF THE GUEST NETWORK 19 PROPRIETARY AND CONFIDENTIAL SMART CONNECT 20 PROPRIETARY AND CONFIDENTIAL THE CHALLENGES OF CONSUMERIZATION > Setup Connectivity without assistance? • Self Service Provisioning • Remove IT overhead • Quick easy access made secure > Differentiate between corporate and personal devices? • Grant different levels of network access • Enforce policies (password set, device locked etc) 21 PROPRIETARY AND CONFIDENTIAL TRADITIONAL UNENCRYPTED GUEST NETWORKS > Traditionally Guest Networks are built with • web authentication • no encryption Unencrypted Internet Access Point Web Authentication Wireless Controller > Lack of encryption means once you connect everyone can see your traffic > In addition Web Authentication is easy, but not seamless • You need to open a web browser and enter a username/password • On the other hand 802.1x happens automatically in the background 22 PROPRIETARY AND CONFIDENTIAL 802.1X IS THE ANSWER, BUT… 802.1x (WPA/WPA2) is hard to configure on clients 4. Trust the server 2. Select your protocol 1. Connect to a network 5. Choose how you send your username 3. Select the EAP type 23 PROPRIETARY AND CONFIDENTIAL certificate (lets hope its installed already) AUTOMATED CLIENT CONFIGURATION WITH SMARTCONNECT Access Point 1. Authenticate using web authentication 2. Download an applet 3. Automatically connect to configure 802.1x with 802.1x Identity Manager automates the configuration through a downloadable agent from the guest portal Supported Today: 24 PROPRIETARY AND CONFIDENTIAL Windows iPad/iPhone Apple Mac Android More to Come… WALKTHROUGH STEP 1 – INITIAL CONNECTION Identity Manager Access Point Wireless Controller 1. User connects to “provisioning” or “guest” SSID 2. Opens their web browser and gets redirected to the Identity Manager by the captive portal on the Wireless controller. 3. The Identity Manager works out that an iPad (or any device) has connected and displays a web portal designed for that device. 25 PROPRIETARY AND CONFIDENTIAL WALKTHOUGH STEP 2 - PROVISIONING 1. User enters AD authentication 2. Identity Manager verifies it on PROPRIETARY AND CONFIDENTIAL corporate AD 26 3. Identity Manager delivers an iPad Profile 4. User accepts and install it 5. User reconnects to the network using enterprise settings WALKTHROUGH STEP 3 – CONNECT SECURELY • Now the device connects automatically at every access • Communication secured by WPA Enterprise 802.1x • Authentication against Identity Manager or Enterprise RADIUS Identity Manager 802.1x Access Point 27 PROPRIETARY AND CONFIDENTIAL RADIUS Wireless Controller POLICY CONTROL Now you have devices connected you can apply policy to them • Where can they do? • Full Role Based Access Control • Per User Firewall rules, VLAN assignments etc • Policies by user or device • Different for corporate device vs personal device • When and Where • Where can they access from • Time of Day Restrictions 28 PROPRIETARY AND CONFIDENTIAL TYPICAL DEPLOYMENT Meru Controller Internet wireless or wired Username: guestname IP Address: 192.168.1.1 Login Time: 11:30 Logout Time: 12:15 Out of Band Meru Identity Manager 29 PROPRIETARY AND CONFIDENTIAL DEPLOYMENT OPTIONS VMware Virtual Appliance Meru Services Appliance Installs into a VMware virtual machine running on VMware Server, ESX or ESXi Supported on SA200 and SA2000 Licensed by Concurrent users for each feature: Guest Management & SmartConnect Scalable from Fifty Users to Thousands Active/Active High availability supported between any two nodes 30 PROPRIETARY AND CONFIDENTIAL LICENSING OVERVIEW > Identity Manager • Customer purchased hardware (SA200/2000) or VMware base SKU • License-able Features added to the Identity Manager platform to turn on features on a concurrent user basis Identity Manager Guest Management Smart Connect Other license-able features > Guest Management • Licensed by concurrent guest users at any one time > Smart Connect • Licensed by active users who have been setup by Smart Connect 31 PROPRIETARY AND CONFIDENTIAL NEW MAJOR FEATURES > Smart Connect for MAC OSX • Full downloadable application supports 10.5, 10.6, 10.7 > Smart Connect for Ubuntu Linux • Supports 11.04 and later > Smart Connect for Kindle Fire • Supports Amazon Fire for 802.1X configuration > Advanced Authorization Policy • Wizard based setup • Allows complex rules to be built (such as is user an employee and the device corporate owned) 32 PROPRIETARY AND CONFIDENTIAL Thank you 33 PROPRIETARY AND CONFIDENTIAL