The customer wants posture assessment of the user virtual systems (though
located on a central thin-client server) and not the thin client hardware
themselves. It is possible for one user to have viruses on his virtual PC
because of not updating his antivirus signatures or patches or etc.
My client wants a solution that would assess each user's virtual system and
restrict network access if it should be found to be non-compliant. Note that
a user may access his system from any thin-client.
I want to believe that this makes my requirements clearer. Perhaps you could
suggest a solution or technology for me.
Hmm.
Obviously you can't do port-based NAC becase the switch ports will be
shared by >1 system, possibly very many?
Cisco support EAP over UDP, which allows you to do 802.1x (and thus NAC)
through non-802.1x switches to a supporting router. You'd need the cisco
NAC client I suspect, and it's non-standard so it might be a bit of a
lock-in.
What virtualisation technology are the user systems on? It might be
possible to instruct the hypervisor to move a virtual system off the
"normal" virtual switch/bridge to a "banned" one, and implement this by
extracting last-seen times from windows update / AV console logs (we do
this with non-virtual systems)
Thanks,
Felix
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
