Extreme Networks Sentriant AG Safety guide

Extreme Networks, Inc.
3585 Monroe Street
Santa Clara, California 95051
[phone]
[phone]
http://www.extremenetworks.com
Sentriant AG Software Users Guide, Version 5.2
Published: January 2009
Part number: 120502-00 Rev 01

AccessAdapt, Alpine, Altitude, BlackDiamond, EPICenter, Essentials, Ethernet Everywhere, Extreme Enabled,
Extreme Ethernet Everywhere, Extreme Networks, Extreme Standby Router Protocol, Extreme Turbodrive,
Extreme Velocity, ExtremeWare, ExtremeWorks, ExtremeXOS, Go Purple Extreme Solution, ScreenPlay, Sentriant,
ServiceWatch, Summit, SummitStack, Triumph, Unified Access Architecture, Unified Access RF Manager,
UniStack, the Extreme Networks logo, the Alpine logo, the BlackDiamond logo, the Extreme Turbodrive logo, the
Summit logos, and the Powered by ExtremeXOS logo are trademarks or registered trademarks of Extreme
Networks, Inc. or its subsidiaries in the United States and/or other countries.
sFlow is a registered trademark of InMon Corporation.
Specifications are subject to change without notice.
All other registered trademarks, trademarks, and service marks are property of their respective owners.
© 2009 Extreme Networks, Inc. All Rights Reserved.

Sentriant AG Software Users Guide, Version 5.2 3
Table of Contents
List of Figures ............................................................................................................................... 15
List of Tables ................................................................................................................................ 21
Chapter 1: Introduction.................................................................................................................. 23
Sentriant AG Home Window .......................................................................................................23
System Monitor.........................................................................................................................24
Sentriant AG v5.2 for v4.x Users ................................................................................................26
Overview ..................................................................................................................................29
The Sentriant AG Process.....................................................................................................31
About Sentriant AG .............................................................................................................31
NAC Policy Definition ....................................................................................................31
Endpoint Testing...........................................................................................................31
Compliance Enforcement ...............................................................................................32
Automated and Manual Repair........................................................................................32
Targeted Reporting ........................................................................................................33
Technical Support.....................................................................................................................33
Additional Documentation..........................................................................................................33
Installing and Upgrading............................................................................................................34
Conventions Used in This Document ...........................................................................................34
Navigation Paragraph...........................................................................................................34
Note Paragraph ...................................................................................................................34
Caution Paragraph...............................................................................................................34
Warning Paragraph ..............................................................................................................35
Bold Font ...........................................................................................................................35
Task Paragraph ...................................................................................................................35
Italic Text...........................................................................................................................35
Courier Font .......................................................................................................................36
Angled Brackets..................................................................................................................36
Square Brackets..................................................................................................................36
Terms ................................................................................................................................37
Copying Files ............................................................................................................................37
SCP ...................................................................................................................................37
PSCP .................................................................................................................................37
Users’ guide online help ............................................................................................................38
Chapter 2: Clusters and Servers ..................................................................................................... 43
Single-server Installation......................................................................................................44
Multiple-server Installations .................................................................................................44
Chapter 3: System Configuration .................................................................................................... 47
Introduction .............................................................................................................................47
Enforcement Clusters and Servers...............................................................................................48
Enforcement Clusters ................................................................................................................49

Sentriant AG Software Users Guide, Version 5.2
4
Adding an Enforcement Cluster ............................................................................................49
Editing Enforcement Clusters ...............................................................................................51
Viewing Enforcement Cluster Status......................................................................................51
Deleting Enforcement Clusters..............................................................................................52
Enforcement Servers .................................................................................................................53
Adding an ES......................................................................................................................53
Cluster and Server Icons ......................................................................................................54
Editing ESs ........................................................................................................................55
Changing the ES Network Settings........................................................................................56
Changing the ES Date and Time ...........................................................................................57
Modifying the ES SNMP Settings..........................................................................................58
Modifying the ES root Account Password ...............................................................................58
Viewing ES Status ...............................................................................................................58
Deleting ESs.......................................................................................................................59
ES Recovery .......................................................................................................................60
Management Server...................................................................................................................60
Viewing Network Settings.....................................................................................................60
Modifying MS Network Settings ............................................................................................62
Selecting a Proxy Server.......................................................................................................63
Setting the Date and Time ...................................................................................................63
Automatically Setting the Time.............................................................................................64
Manually Setting the Time ...................................................................................................64
Selecting the Time Zone ......................................................................................................65
Enabling SNMP ..................................................................................................................65
Modifying the MS root Account Password ..............................................................................66
Checking for Sentriant AG Upgrades .....................................................................................66
Changing the Sentriant AG Upgrade Timeout .........................................................................67
User Accounts ..........................................................................................................................67
Adding a User Account ........................................................................................................67
Searching for a User Account ...............................................................................................70
Sorting the User Account Area..............................................................................................71
Copying a User Account .......................................................................................................71
Editing a User Account ........................................................................................................72
Deleting a User Account ......................................................................................................73
User Roles................................................................................................................................74
Adding a User Role .............................................................................................................74
Editing User Roles ..............................................................................................................77
Deleting User Roles.............................................................................................................78
Sorting the User Roles Area..................................................................................................78
License ....................................................................................................................................78
Updating Your License Key ..................................................................................................78
Test Updates ............................................................................................................................79
Manually Checking for Test Updates .....................................................................................80
Selecting Test Update Times................................................................................................81
Viewing Test Update Logs ....................................................................................................81
Quarantining, General................................................................................................................82
Selecting the Quarantine Method..........................................................................................83
Selecting the Access Mode...................................................................................................84
Quarantining, 802.1X................................................................................................................84
Entering Basic 802.1X Settings............................................................................................85
Authentication Settings .......................................................................................................85

Sentriant AG Software Users Guide, Version 5.2 5
Selecting the RADIUS Authentication method..................................................................85
Configuring Windows Domain Settings.............................................................................86
Configuring OpenLDAP Settings......................................................................................88
Adding 802.1X Devices .......................................................................................................91
Testing the Connection to a Device .......................................................................................92
Cisco IOS ...........................................................................................................................93
Cisco CatOS .......................................................................................................................95
CatOS User Name in Enable Mode ..................................................................................97
Enterasys ...........................................................................................................................98
Extreme ExtremeWare..........................................................................................................99
Extreme XOS ....................................................................................................................101
Foundry............................................................................................................................102
HP ProCurve Switch ..........................................................................................................104
HP ProCurve WESM xl or HP ProCurve WESM zl ..................................................................107
HP ProCurve 420 AP or HP ProCurve 530 AP ......................................................................110
Nortel ..............................................................................................................................112
Other ...............................................................................................................................113
Quarantining, DHCP ................................................................................................................115
DHCP Server Configuration ................................................................................................115
Setting DHCP Enforcement ................................................................................................115
Adding a DHCP Quarantine Area.........................................................................................117
Sorting the DHCP Quarantine Area......................................................................................119
Editing a DHCP Quarantine Area.........................................................................................119
Deleting a DHCP Quarantine Area .......................................................................................120
Quarantining, Inline ................................................................................................................120
Post-connect ..........................................................................................................................120
Allowing the Post-connect Service Through the Firewall ........................................................120
First Time Selection ..........................................................................................................121
Setting Sentriant AG Properties ..........................................................................................121
Configuring a Post-connect System .....................................................................................121
Launching Post-connect Systems........................................................................................123
Post-connect in the Endpoint Activity Window......................................................................123
Adding Post-connect System Logos and Icons ......................................................................124
Maintenance...........................................................................................................................125
Initiating a New Backup.....................................................................................................126
Restoring From a Backup ...................................................................................................127
Downloading Support Packages ................................................................................................127
Cluster Setting Defaults ...........................................................................................................127
Testing Methods ...............................................................................................................128
Selecting Test Methods................................................................................................128
Ordering Test Methods.................................................................................................129
Recommended Test Methods........................................................................................129
Selecting End-user Options ................................................................................................130
Accessible Services ...........................................................................................................130
Exceptions........................................................................................................................132
Always Granting Access to Endpoints and Domains.........................................................132
Always Quarantine Endpoints and Domains....................................................................134
Notifications.....................................................................................................................134
Enabling Notifications .................................................................................................134
End-user Screens ..............................................................................................................136
Specifying an End-user Screen Logo .............................................................................136
Specifying the End-user Screen Text .............................................................................137

Sentriant AG Software Users Guide, Version 5.2
6
Specifying the End-user Test Failed Pop-up Window.......................................................138
Agentless Credentials ........................................................................................................139
Adding Windows Credentials.........................................................................................139
Testing Windows Credentials ........................................................................................140
Editing Windows Credentials ........................................................................................141
Deleting Windows Credentials.......................................................................................141
Sorting the Windows Credentials Area ...........................................................................142
Logging..................................................................................................................................142
Setting ES Logging Levels..................................................................................................142
Setting 802.1X Devices Logging Levels ...............................................................................144
Advanced Settings ..................................................................................................................144
Setting the Agent Read Timeout .........................................................................................144
Setting the RPC Command Timeout ....................................................................................145
Chapter 4: Endpoint Activity......................................................................................................... 147
Filtering the Endpoint Activity Window ......................................................................................148
Filtering by Access Control or Test Status ............................................................................148
Filtering by Time...............................................................................................................149
Limiting Number of Endpoints Displayed.............................................................................150
Searching.........................................................................................................................150
Access Control States ..............................................................................................................151
Endpoint Test Status ...............................................................................................................152
Enforcement Cluster Access Mode ............................................................................................155
Viewing Endpoint Access Status ...............................................................................................156
Selecting Endpoints to Act on ..................................................................................................157
Acting on Selected Endpoints...................................................................................................158
Manually Retest an Endpoint..............................................................................................158
Immediately Grant Access to an Endpoint............................................................................158
Immediately Quarantine an Endpoint ..................................................................................159
Clearing Temporary Endpoint States....................................................................................159
Viewing Endpoint Information...................................................................................................160
Troubleshooting Quarantined Endpoints ....................................................................................162
Chapter 5: End-user Access ......................................................................................................... 167
Test Methods Used .................................................................................................................167
Agent Callback..................................................................................................................167
Endpoints Supported...............................................................................................................168
Browser Version ......................................................................................................................169
Firewall Settings .....................................................................................................................170
Managed Endpoints...........................................................................................................170
Unmanaged Endpoints.......................................................................................................170
Making Changes to the Firewall ..........................................................................................170
Windows Endpoint Settings......................................................................................................170
IE Internet Security Setting................................................................................................170
Agent-based Test Method...................................................................................................171
Ports Used for Testing .................................................................................................171
Windows Vista Settings ................................................................................................171
Agentless Test Method.......................................................................................................171
Configuring Windows 2000 Professional for Agentless Testing .........................................171
Configuring Windows XP Professional for Agentless Testing .............................................172

Sentriant AG Software Users Guide, Version 5.2 7
Configuring Windows Vista for Agentless Testing ............................................................173
Defining the Agentless Group Policy Object....................................................................174
Ports Used for Testing .................................................................................................182
Allowing the Windows RPC Service through the Firewall..................................................182
ActiveX Test Method..........................................................................................................184
Ports Used for Testing .................................................................................................184
Windows Vista Settings ................................................................................................184
Mac OS X Endpoint Settings ....................................................................................................184
Ports Used for Testing .......................................................................................................184
Allowing Sentriant AG through the OS X Firewall ..................................................................184
End-user Access Windows........................................................................................................187
Opening Window ...............................................................................................................188
Windows NAC Agent Test Windows .....................................................................................189
Automatically Installing the Windows Agent ...................................................................189
Removing the Agent ....................................................................................................191
Manually Installing the Windows Agent..........................................................................192
How to View the Windows Agent Version Installed...........................................................193
Mac OS Agent Test Windows ..............................................................................................194
Installing the MAC OS Agent ........................................................................................194
Verifying the Mac OS Agent..........................................................................................197
Removing the Mac OS Agent ........................................................................................200
ActiveX Test Windows ........................................................................................................201
Agentless Test Windows.....................................................................................................202
Testing Window.................................................................................................................204
Test Successful Window ....................................................................................................204
Testing Cancelled Window..................................................................................................205
Testing Failed Window.......................................................................................................205
Error Windows...................................................................................................................207
Customizing Error Messages .....................................................................................................207
Chapter 6: NAC Policies .............................................................................................................. 215
Standard NAC Policies.............................................................................................................216
NAC Policy Group Tasks ..........................................................................................................216
Add a NAC Policy Group ....................................................................................................216
Editing a NAC Policy Group................................................................................................217
Deleting a NAC Policy Group ..............................................................................................218
NAC Policy Tasks ....................................................................................................................219
Enabling or Disabling an NAC Policy ...................................................................................219
Selecting the Default NAC Policy ........................................................................................219
Creating a New NAC Policy ................................................................................................219
Editing a NAC Policy .........................................................................................................225
Copying a NAC Policy ........................................................................................................225
Deleting a NAC Policy........................................................................................................226
Moving a NAC Policy Between NAC Policy Groups ................................................................226
Assigning Endpoints and Domains to a Policy ......................................................................226
NAC Policy Hierarchy ........................................................................................................227
Setting Retest Time...........................................................................................................227
Setting Connection Time....................................................................................................227
Defining Non-supported OS Access Settings ........................................................................228
Setting Test Properties ......................................................................................................228
Selecting Action Taken ......................................................................................................228
About Sentriant AG Tests.........................................................................................................230

Sentriant AG Software Users Guide, Version 5.2
8
Viewing Information About Tests.........................................................................................230
Selecting Test Properties ...................................................................................................230
Entering Software Required/Not Allowed........................................................................230
Entering Service Names Required/Not Allowed...............................................................231
Entering the Browser Version Number ...........................................................................231
Test Icons ........................................................................................................................232
Chapter 7: Quarantined Networks .................................................................................................233
Endpoint Quarantine Precedence..............................................................................................233
Using Ports in Accessible Services and Endpoints ......................................................................234
Always Granting Access to an Endpoint .....................................................................................236
Always Quarantining an Endpoint..............................................................................................237
New Users..............................................................................................................................237
Shared Resources ...................................................................................................................238
Untestable Endpoints and DHCP Mode .....................................................................................238
Windows Domain Authentication and Quarantined Endpoints ......................................................239
Chapter 8: High Availability and Load Balancing ........................................................................... 241
High Availability......................................................................................................................241
Load Balancing.......................................................................................................................245
Chapter 9: Inline Quarantine Method ............................................................................................ 247
Chapter 10: DHCP Quarantine Method .......................................................................................... 249
Configuring Sentriant AG for DHCP ...........................................................................................250
Setting up a Quarantine Area..............................................................................................251
Router Configuration .........................................................................................................251
Configuring the Router ACLs ........................................................................................251
Configuring Windows Update Service for XP SP2..................................................................251
Chapter 11: 802.1X Quarantine Method........................................................................................ 253
About 802.1X.........................................................................................................................253
Sentriant AG and 802.1X.........................................................................................................254
Setting up the 802.1X Components ..........................................................................................258
Setting up the RADIUS Server ............................................................................................258
Using the Sentriant AG IAS Plug-in to the Microsoft IAS RADIUS Server ..........................258
Configuring the Microsoft IAS RADIUS Server ................................................................260
Proxying RADIUS Requests to an Existing RADIUS Server Using the Built-in Sentriant AG
RADIUS Server ...........................................................................................................281
Using the Built-in Sentriant AG RADIUS Server for Authentication...................................284
Enabling Sentriant AG for 802.1X.......................................................................................284
Sentriant AG User Interface Configuration .....................................................................284
Setting up the Supplicant ..................................................................................................285
Windows XP Professional Setup ....................................................................................286
Windows XP Home Setup .............................................................................................287
Windows 2000 Professional Setup ................................................................................288
Windows Vista Setup ...................................................................................................290
Setting up the Authenticator ..............................................................................................292
Cisco® 2950 IOS........................................................................................................293
Cisco® 4006 CatOS ....................................................................................................293

Sentriant AG Software Users Guide, Version 5.2 9
Enterasys® Matrix 1H582-25 ......................................................................................294
Extreme® Summit 48si ...............................................................................................294
ExtremeWare ..............................................................................................................295
ExtremeXOS................................................................................................................296
Foundry® FastIron® Edge 2402...................................................................................296
HP ProCurve 420AP ....................................................................................................297
HP ProCurve 530AP ....................................................................................................297
HP ProCurve 3400/3500/5400 ....................................................................................299
Nortel® 5510.............................................................................................................299
Creating Custom Expect Scripts ....................................................................................300
Chapter 12: API........................................................................................................................... 305
Overview ................................................................................................................................305
Setting Sentriant AG Properties ................................................................................................306
Setting Firewall Rules..............................................................................................................307
Sentriant AG Events Generated.................................................................................................307
Examples of Events Generated............................................................................................308
Java Program and Command for Events ...............................................................................310
Sentriant AG Requests Supported.............................................................................................310
Examples of Requests........................................................................................................311
Post-connect Request Example...........................................................................................313
Java Program and Command for Requests ...........................................................................314
Chapter 13: Remote Device Activity Capture ................................................................................. 315
Creating a DAC Host................................................................................................................315
Downloading the EXE File ..................................................................................................316
Running the Windows Installer ...........................................................................................316
Adding Additional Interfaces ..............................................................................................323
Configuring the MS and ES for DAC ....................................................................................324
Adding Additional ESs .......................................................................................................324
Starting the Windows Service .............................................................................................325
Viewing Version Information ...............................................................................................326
Removing the Software ......................................................................................................326
Sentriant AG to Infoblox Connector ...........................................................................................328
Configuring the Infoblox Server...........................................................................................328
Configuring Sentriant AG ...................................................................................................328
Chapter 14: Reports .................................................................................................................... 331
Generating Reports..................................................................................................................332
Viewing Report Details.............................................................................................................334
Printing Reports......................................................................................................................336
Saving Reports to a File ...........................................................................................................336
Converting an HTML Report to a Word Document .......................................................................336
Chapter 15: DHCP Plug-in............................................................................................................ 339
Installation Overview ...............................................................................................................340
DHCP Plug-in and the Sentriant AG User Interface.....................................................................342
Installing the Plug-in .........................................................................................................342
Enabling the Plug-in and Adding Servers .............................................................................345
Viewing DHCP Server Plug-in Status ...................................................................................347

Sentriant AG Software Users Guide, Version 5.2
10
Editing DHCP Server Plug-in Configurations.........................................................................348
Deleting a DHCP Server Plug-in Configuration......................................................................348
Disabling a DHCP Server Plug-in Configuration ....................................................................349
Enabling a DHCP Server Plug-in Configuration .....................................................................349
Chapter 16: System Administration...............................................................................................351
Launching Sentriant AG...........................................................................................................351
Launching and Logging into Sentriant AG ............................................................................351
Logging out of Sentriant AG ...............................................................................................351
Important Browser Settings ................................................................................................351
Restarting Sentriant AG System Processes.................................................................................351
Managing your Sentriant AG License .........................................................................................352
Entering a New License Key ...............................................................................................352
Downloading New Tests ...........................................................................................................353
System Settings ......................................................................................................................354
DNS/Windows Domain Authentication and Quarantined Endpoints .........................................354
Matching Windows Domain Policies to NAC Policies .............................................................355
Setting the Access Mode....................................................................................................355
Naming Your Enforcement Cluster ......................................................................................356
Changing the MS Host Name..............................................................................................356
Changing the ES Host Name ..............................................................................................356
Changing the MS or ES IP Address .....................................................................................356
Resetting your System .......................................................................................................357
Resetting your Test Data ....................................................................................................358
Changing Properties ..........................................................................................................359
Specifying an Email Server for Sending Notifications............................................................360
Entering Networks Using CIDR Format ......................................................................................360
Database................................................................................................................................361
Creating a Backup File.......................................................................................................361
Changing the Backup Timeouts ..........................................................................................361
Restoring from Backup ......................................................................................................362
Restoring to a new Server.............................................................................................362
Restoring to the Same Server .......................................................................................362
Restoring the Original Database..........................................................................................363
Generating a Support Package............................................................................................364
System Requirements..............................................................................................................364
Supported VPNs......................................................................................................................365
Adding Custom Tests...............................................................................................................366
Introduction......................................................................................................................366
References .......................................................................................................................366
Changing the Error Messages in a Test Script.......................................................................366
Creating a Custom Test Class Script from Scratch ................................................................370
BasicTests API..................................................................................................................378
End-user Access Windows........................................................................................................386
How Sentriant AG Handles Static IP Addresses ..........................................................................387
Managing Passwords ...............................................................................................................388
Resetting the Sentriant AG Server Password.........................................................................389
Resetting the Sentriant AG Database Password ....................................................................390
Changing the Sentriant AG Administrator Password ..............................................................390
When the Password is Known .......................................................................................390