High Availability - HP 800 User Manual

Test method Trade-offs
Pros
ActiveX plug-in • No installation or upgrade to maintain.
• Supports all Windows operating systems.
• Only Internet Explorer application access
ProCurve NAC EI • Always available for retesting.
Agent
• The agent is automatically updated with
• Supports all Windows platforms.
Table 1-1. Test Methods (cont.)
required through personal firewall. Must
open port 1500.
product updates.
The following list highlights key features:
■ Enforcement options – NAC 800 provides multiple enforcement
options for quarantining endpoints that do not comply with your
security policy (Inline, DHCP, and 802.1X). This enables NAC 800 to
enforce compliance across complex, heterogeneous networks.
High availability and load balancing – A multi-server NAC 800 deploy-
■
ment is mutually supporting. Should one server fail, other nodes
within a cluster will automatically provide coverage for the affected
network segment.
Load balancing is achieved by an algorithm that spreads the endpoint
testing load across all ESs in a cluster.
■ Multiple-user, role-based access – In enterprise deployments
numerous individuals, each with varying responsibilities, typically
require access to information within NAC 800. Role-based access
enables system administrators to control who has access to the data,
the functions they are allowed to perform, and the information they
can view and act on. Role-based access ensures the integrity of the
enterprise-wide NAC 800 deployment and creates the separation of
duties that conforms to security best-practices.
Cons
• No retesting of endpoint once browser is
closed.
• Not supported by non-Windows operating
systems.
• Browser security settings must allow
ActiveX control operation of signed and safe
controls. This is the default for the Internet
zone. Raise the Internet zone setting and
make
NAC 800 part of the trusted zone.
• Requires interaction from end-users—they
must download the control before they can
access network.
• Install and upgrade to maintain.
• Requires one-time interaction from end-
users—they must download and install
before they can access network.
Introduction
Overview
1-9