2
Network Access Control as a Network Security solution
By
Conor Ryan
Submitted in partial fulfilment of the requirements for Bachelor of
Science Degree (Hons)
In IT Management
Institute of Technology Tallaght Dublin
Author: Conor Ryan
Supervised by: Enda Lee, Lecturer at IT Tallaght

3
Contents
Abstract......................................................................................................................................5
1 Project Introduction...........................................................................................................6
1.1 Project Plan .................................................................................................................6
1.1.1 Target audience ...................................................................................................6
2 Network Access Control.....................................................................................................6
2.1 Background..................................................................................................................6
2.2 Policies.........................................................................................................................7
2.3 Benefits of Network Access Control............................................................................7
2.4 Problems NAC solves...................................................................................................8
2.5 Components ................................................................................................................8
2.5.1 Users.....................................................................................................................9
2.5.2 Remediation.........................................................................................................9
2.6 Points of enforcement ..............................................................................................10
2.6.1 Port-based NAC..................................................................................................10
2.6.2 Gateway based NAC...........................................................................................10
2.6.3 Which is more suited .........................................................................................11
3 Project Implementation...................................................................................................11
3.1 PacketFence ..............................................................................................................11
3.1.1 PacketFence ZEN................................................................................................11
3.2 Phase 1......................................................................................................................12
3.2.1 Network Setup ...................................................................................................12
3.2.2 PacketFence ZEN Appliance...............................................................................13
3.2.3 Virtual Machine..................................................................................................14
3.2.4 Phase Review.....................................................................................................15
3.3 Phase 2......................................................................................................................16
3.3.1 Web Configurator GUI .......................................................................................16
3.3.2 Phase Review.....................................................................................................21
3.4 Phase 3......................................................................................................................22
3.4.1 Administration and testing ................................................................................22
3.4.2 Phase Review.....................................................................................................32
3.5 PacketFence ZEN review ...........................................................................................33

4
3.6 Other Technologies ...................................................................................................34
3.6.1 Check Point Security Gateway ...........................................................................34
3.6.2 Review................................................................................................................37
4 Conclusion........................................................................................................................37
4.1 Implementation Review............................................................................................38
4.1.1 Phase 1...............................................................................................................38
4.1.2 Phase 2...............................................................................................................38
4.1.3 Phase 3...............................................................................................................38
4.1.4 Other Technologies............................................................................................38
4.2 Limitations.................................................................................................................38
4.3 Recommendations ....................................................................................................39
5 References........................................................................................................................40
Appendix ..................................................................................................................................41
Table of Figures....................................................................................................................41

5
Abstract
This project provides an investigation into the topic of Network Access Control as a network
security solution. It details the purpose of NAC solutions, as well as the method for
configuration regarding a specific network architecture and also an insight into some of a
NAC solutions features. This project tests the method of deployment as well as investigating
other paths of deployment and implementation. Aspects such as testing of a user gaining
access to a networks resources, and the overall management of a NAC solution are the main
priorities regarding integration of this projects implementation section. The overall
objective of this project being to portray an in-depth understanding of the concept of
network access control and its essential workings.

6
1 Project Introduction
This document has been prepared to present a detailed and researched review on the topic
of Network Access Control (NAC), which is based around the element of network security
and IT governance. Essentially, the overall drive of this project being to investigate NAC in
relation to its suitability as an effective networking security solution. Such aspects which will
be conveyed within this report will relate to the overall project scope, aims, and possible
users of the technology. Technology comparisons and possible implementation methods in
order to physically test this study will also be examined.
Other topics which will be regarded will include the platforms of implementation and
different methods of integration. Whether a specific solution is more feasible than another
and which will portray the functionality and features of Network access control more
suitably. Factors such as Risk of development within a chosen solution and specific
hardware requirements will also be touched on.
1.1 Project Plan
The purpose of this project is to investigate whether or not Network access control is a
suitable method of security on a networks access. The overall goal of the project being to
gain an in-depth understanding of NAC, and successfully demonstrate Network access
control by exercising a NAC solution and demonstrating some of its characteristics. The
reason for this being to test whether it is an effective method of security in relation to a
managing and monitoring network access. PacketFence is a considered solution chosen to
be demonstrated and examined in order to test NAC as a security solution and also to
develop an in-depth understanding of NAC software and how it works. The overall goal
being to efficiently exercise this solution in a lab environment in order to convey some of its
key features, those of which are characteristics of network access control.
1.1.1 Target audience
The audience in which this project is aimed at consists of any end user wanting to gain
access to the materials and resources of the network. It could also be of interest to any
individual interested in utilising NAC software as a mechanism to apply another degree of
security to a specific network. This project will demonstrate the capabilities of NAC put into
perspective for users/individuals whether it is deemed useful for their personal
requirements or needs.
2 Network Access Control
2.1 Background
It is imperative that a business or enterprise of any scale has the ability to control access to
their networks resources. This primarily being so as to ensure network security and
compliance within that organisations network. Network access control (NAC) is an approach
which restricts access to network resources to known/ unknown devices (phones,
workstations, servers, etc.) which are requesting access to a particular network. It is

7
essentially a new method of security that has not quite made its stamp on IT security just
yet, although has an intriguing level of promise bound to it. NACs aim is to control access to
a network using a strict set of policies and assessment checks of the devices or endpoints
requesting network access or resources within a network. NAC ensures only policy-
compliant individuals and devices can obtain access to a networks attributes (Cygnia.co.uk,
July 2, 2009). Solutions based around Network access control are designed in a way which
provided the ability to prevent end-devices that are absent of antivirus or host intrusion
prevention software from admitting themselves to a network. Beneficially halting devices
which violate the policy of an outdated spyware check can be crucial to a network
environment. Infected devices can damage a networks infrastructure by contaminating and
leaving other users of the network at risk of infection due to viruses and other unwanted
malicious attributes. NAC solutions provide in depth and precise monitoring of the users and
machines which request/ gain access to a network. A wide range of policies and chosen
rules can be integrated to most appropriately suite the network environment.
2.2 Policies
Policies are fundamentally the core element of every NAC solution. They are the protocols
or set of rules bound to a network by the solution in order to effectively implement a
certain level of security onto a networks access or resources. These policies can be
customised in a way which suits an organisation best and defines the network into the way
in which they want it to be utilised. These policies focus mostly on endpoint security actions
and offer elements such as anti-virus, anti-spyware, firewalls and other anti-malware
attributes all utilised in a way which makes endpoint security invulnerable to attacks or
hackings of the network. Policies can be as simple as literally the types of computer a user is
using to the role of a specific user, these elements can be used as policies of access to a
network.
2.3 Benefits of Network Access Control
Some of the major reasons to consider NAC as a security software solution are
 Restricts the amount of data and resources that a certain user can access.
 NAC can implement a certain degree of anti-threat solutions that protect against
intrusion and viral infection by using applications such as firewalls, spyware software
and antivirus based software.
 Another feature of Network access control software is that once applied it can
majorly moderate and restrict the amount of resources a user can utilise once access
is granted to the specific network.
 Efficient policy enforcement in regards to rules in which must be abide by in order to
be granted access to a network and its related resources.
 Using NAC software in a business place where the amount of users utilising the
network can be monitored, is ideal for deployment.
 NAC enforces policies for different sets of users depending on the method of entry
to the network

8
 It is a resilient and reliable way to keep your network clean of any malicious activity
if policies are set to do so.
Figure 1- NACremediation
2.4 Problems NAC solves
Integration of Network access control onto a network allows for substantial interaction with
some common network security issues. In regards to the problems which NAC resolves, one
which is most notable and regarded upon is the implementation of endpoint integrity. This
feature of a NAC solution solves the problem of users obtaining unlimited access to a
specific network and its resources. It solves this problem by running an endpoint or access
assessment test of an endpoint, in order to deploy a certain level of rules onto it and
ensuring that this endpoint meets the particular protocols that the network has
implemented. It is these access control policies that must be adhered to, which make NAC
effective against unwanted access.
The implementation of Network access control will generate a strong, granular and
centralised element of access control upon a network. Defining a persistent and flexible
method of tackling problems such as malware intrusions, data breaches, unauthorised
access and also comes with the ability to enforce regulatory compliance checks. Compliance
checks can be performed through the use of mandatory performance scans, registry keys or
personal authentication attributes.
2.5 Components
After a business has made the decision to implement NAC software onto the desired
network infrastructure as a means for security, there are few factors that have to be
obtained in regards to the necessary components needed to fully utilise a Network access
control solution. All NAC solutions consist of three parts

9
 The Policy Engine: Which is the point in which the specific policies are decided to be
applied onto. It is the most important factor as it controls the NAC deployment by
creating the essential access rules for the user and the monitoring of the
enforcement point of the infrastructure. It also must keep track of the specific rules
it pushes out to all endpoint devices
 Endpoint Agent: retains all user data and policy information, also communicates any
change in device state with the policy engine.
 Policy enforcement point: The point of the infrastructure in which the particular
access rules and policies are resigned to. Also the position that moves users who do
not meet the policy requirement to a quarantined network.
2.5.1 Users
Network access control solutions are beneficial for any organisation, or any agency that is
looking to apply a degree of authentication or access control upon their network resources.
Whether it is in relation to non-zero attacks which is based around anti-viral concepts or
Pre-admission or post-admission concepts which are in regards to policies which take place
before or after access is to be granted. In regards to endpoint clients who utilise the actual
protocols of NAC solutions, there are many types. However, the client usually depends on
the specific device they are utilising and generally they are categorised into three central
groups. Whether it is a laptop, smartphone or Desktop OS and it also depends on the
particular endpoint you have decided to run your software on.
Full agents and lightweight agents are the particular types or methods of installation of the
solution in regards to the specific users that might be interacting with the NAC software and
network at different levels of expertise. A full agent is usually targeted at a corporate
employee who would have regular interaction with the network, this would involve more
detail to the implementation in relation to administrative rights being obtained in order to
fully install this agent. A lightweight agent which is usually applied mainly for guests or
irregulars who have come in requesting network access. Administrative privileges are
typically not needed on the local machine for a lightweight agent making it a bit more
beneficial and easier to deploy.
2.5.2 Remediation
Remediation is a key component in any Network access control solution, it is the method of
migrating a user who does not meet the specific requirements presumed by the solution
and network to a guest network to be serviced. When triggered by the enforcement policy,
the enforcement point moves users that don’t comply with the particular NAC policies to an
abstract quarantined network. It is in this quarantined network, that users must be “fixed”
in order to progress or get re-scanned by the NAC solution. This method of redirecting and
notifying the user is called Remediation.
Remediation can be categorised into two types:

10
 Auto-remediation : where remediation happens automatically once the user is
deemed unsuitable to progress onwards
 User self-remediation : this involves instructions from the endpoint client that the
user must pursue in order to essentially repair their machine or device
2.6 Points of enforcement
An important aspect of Network Access Control that must be considered by any entity
wishing to utilise a NAC solution, is the path in which the NAC is to be performed upon.
Generally, access control is deployed in two types of methods within the network
infrastructure, those of which are Port-based and Gateway Based NAC.
2.6.1 Port-based NAC
This path of NAC deployment is fundamentally constructed around the port security
element on an 802.1X-complaint network switch. Port-based NAC is integrated around the
idea of enforcing integral switch port security through the use of 802.1X. 802.1x is an IEEE
standard of security used for authentication over a wired or wireless LAN through the use of
Extensible Authentication Protocol (EAP) packets. The hosts authenticate using an EAP
attribute before layer 2 datalink access is provided to the particular network (Cygnia.co.uk,
July 2, 2009).A solution that is designed around Port-based deployment will quarantine
devices or machines that are deemed non-compliant, or that do not pass specific policy
requirements at the edge of the network. The enforcement point of port-based NAC is
therefore places on the Switch or wireless access point. This means that the quarantine
zone in which non-compliant guests are placed is within a dedicated isolation VLAN or port
ACL.
2.6.1.1 Issues 0f port-based
Some of the issues regarding port-based deployment include factors such as the actual
deployment of this method. Port-based deployment can be a very complex process and can
be very difficult to implement, especially on large scale networks. This is due to
complications in switch requirements as well as component integration within the network
infrastructure along with device compatibilities (do the switches support 802.1x etc.).
Difficulty can also arise while attempting to segment the network into the required VLANs
necessary to support 802.1x. Configuration of RADIUS servers, interfaces and determining
the NAC standards that will be appropriate for the infrastructure are also key elements
which can be difficult to resolve. Many skills are needed to manage a 802.1x deployment of
Network Access Control on a network infrastructure.
2.6.2 Gateway based NAC
Gateway-based NAC deployment works in a different way to port-based deployment. Port-
based deployment performs its enforcement within layer 2 (data-link) whereas gateway
deployment operates it enforcement within Layer 3 at the network level. It performs
restricts in relation to device IP addresses. Gateway deployment does not require the use of
EAP and instead uses the abilities of an agent to authenticate through means of

11
identification of the user or machine. The agent is also used to perform health and overall
quality checks on devices which have been identified. The enforcement point of a gateway
deployment is via firewalls, which makes the quarantine zone at the network edge or
default gateway. Gateway-based deployment is a method of network access control that
avoids the complexity of 802.1x port-based deployment, while still exercising a respectable
degree of security within a network architecture.
2.6.3 Which is more suited
Deciding which deployment type is more beneficial for an organisation completely depends
on the company’s goals, and what they want to essentially get out of network access
control. In relation to the two types, gateway deployment is the more cost effective choice.
Gateway-based deployment can be considered more suitable if an organisation has the goal
of performing health checks and providing a mechanism to ensure policy compliance upon
endpoint devices within the network.
If the organisations main objective is to ensure strict security around devices which plug into
the network, 802.1x port-based solutions are better suited. As port-based deployment
prevents unauthorised machines from gaining access when connected to the network
infrastructure via switch or access point.
3 Project Implementation
This section of the project relates to the exercising of Network access control in the form of
a lab environment. The main objective being to test and convey some of the features of
network access control through the utilisation of a NAC solution. The implementation runs
through the setup, configuration and the essential testing of a NAC solution as a mechanism
of demonstrating this topic.
3.1 PacketFence
PacketFence is the solution used to demonstrate and exercise the area of NAC within a lab
environment. PacketFence is a free, open-sourced network access control application
created as a mechanism to authenticate users via a networks identification policies,
examine device states in regards to quality and to present an application for self-
remediation. PacketFence is based around the 802.1x port-based deployment method
regarding network access control and boasts an impressive amount of features in relation to
security methods and policies. With the main solution providing features including Snort IDS
and scans via the Nessus vulnerability scanner.
3.1.1 PacketFence ZEN
Integration of the PacketFence application onto a network architecture can be a complex
task, sometimes taking months to fully implement into a networks environment.
PacketFence ZEN (Zero Effort NAC) is a VMWare, Linux-based appliance which stands as a
compact version of the solution. Although it does not possess half the features that the full
version boasts, it still caters for an effective way to test and exercise some NAC attributes. It

12
provides a slimmed down, pre-compiled version of PacketFence built around a CentOS
operating system.
PacketFence ZEN provides a method of testing NAC in the form of a registration process.
This feature of ZEN allows for the exercising of a key feature of network access control in
the form of authentication of a user based on whether they have “registered” to access the
network.
3.2 Phase 1
3.2.1 Network Setup
The first step in relation to initializing the setup of the demonstration is to construct the
necessary network architecture for efficiently exercising the PacketFence ZEN application.
As stated before this demonstration will demonstrate PacketFences INLINE method of
enforcement as opposed to the out-of-band VLAN enforcement method. This setup of the
application utilises the PacketFence server (the host laptop) as the gateway between the
demonstration device and the internet or specific network in which authorisation is
required.
The network setup for this demonstration consists of a test device (laptop) directly
connected to an entry level switch via Ethernet cable, which is connected via another
Ethernet cable to the host device (PacketFence server). In relation to connectivity between
server and network, this demonstration uses the host laptops Wi-Fi adapter for internet
connectivity. Ethernet connectivity may have been used if the device had an extra network
port. It is crucial that the host device possesses two NICs in order for connectivity between
guest and host and host to network.
Firstly, ensuring network access is obtainable through the demonstration device to the
internet through the host device is the initial step. This is achieved by selecting internet
connection sharing in the host devices network and sharing properties within the control
panel. Leave the connection type at “Ethernet” for the time being, which is to be changed to
the chosen interface by which the inline network is connected to the demonstration device.
3.2.1.1 VLAN out-of-band setup
An alternative network setup which can be constructed is one which will cater for the VLAN
isolation setup which PacketFence can be deployed upon. This setup uses 5 or more virtual
interfaces to cater for the specific states in which PacketFence forces upon the client that
wishes to gain network access. This architecture consists of a number of VLANs those of
which consist of the Management and inline VLANs, as well as a regular, registration and
isolation VLAN for the visitors and guests which are looking to achieve network access. It is

13
also necessary to have a Guest VLAN and a MAC Detection VLAN. The MAC Detection VLAN
is used mostly in a fuller scale operation of PacketFence and is utilised as a means to detect
the devices MAC address that has been connected to the switch and from there it is
processed into the next appropriate VLAN whether it is for remediation or registration
based on the devices current state.
This enforcement type requires a supported switch type in order to create and manage the
specific VLANs. The list of suitable supported switches is available on the website, however
the vast majority of Cisco switches that support VLAN creation, SNMP and have port
security will work just fine.
3.2.2 PacketFence ZEN Appliance
PacketFence is an open source, fully trusted network access control solution (PacketFence,
2015). The Application possesses many impressive features in relation to network security
when deployed effectively on small to large networks through operations that can take
months to deploy. However in order to try to test it in some sort of fashion on a minor scale
network this demonstration will use PacketFence ZEN or Zero effort NAC. PacketFence Zen
is a pre-compiled, Linux based version of the PacketFence solution which only boasts a
fraction of the full products capabilities in terms of network security attributes and
protocols. However, ZEN poses as a good application for demonstrating a port-based
Network access control feature.
3.2.2.1 Download and install
To obtain the product, download the PacketFence Zen Virtual Appliance (OVF) file from the
PacketFence website and unpack its contents. There are a couple of ways in which to install
and boot this version of PacketFence, for this project demonstration testing through a
virtualised method has been chosen in which the unpacked virtual machine appliance image
is mounted within a hypervisor.
3.2.2.1.1 Alternative methods
In relation to other methods of deploying the application, the PacketFence ZEN appliance
can be booted as a “Live” application by burning to a CD or USB stick. By booting the host
device from USB or CD drive the host machine adopts the PacketFence operating system
and through this means becomes the server. This method is useful for demonstrating the
ZEN application to potential clients by simply bringing the disk or stick to their on campus
network In order to demonstrate the application on existing servers or devices without any
pre-configuration.
Some of the issues which arose when this method was tested for this project mostly
revolved around host machine capability. The laptop spec did not seemto be up to par
which result in consistent machine crashes and stress on the device in terms of
performance.

14
3.2.3 Virtual Machine
In regards to the hypervisor in which the appliance can be deployed on there are a couple of
choices. The most effective method of virtualisation comes from VMWare workstation,
VMWare Player and VirtualBox which through testing has been deemed the most
unsuitable. VMWare products are most suited as PacketFence ZEN is a noted VMWare
compatible product. For this demonstration VMware player was chosen.
It is important to dedicate two network adapters to the guest VM, one to cater for the inline
network which will be connected via Ethernet and the other to go out to the internet via Wi-
Fi. It is essential that all interfaces are set to a bridged connection in order for the virtual
machine to communicate with the host OS and essentially receive network access. This is
done so by configuring the adapter states within the “Hardware” section under virtual
machine settings.
Figure 2- VMWare player adapter settings
In order for PacketFence ZEN to perform adequately a dedicated 8 GB of memory is
necessary to ensure efficient execution of the solution. Once the appliance has been
booted in the Virtual Machine, the credentials “root” and “p@ck3tf3nc3” as username and
password are required to login to the interface.
Once login has been achieved it is required that an assigned IP address is used in order to
advance to the web configurator GUI from the PacketFence server. It is from this interface
that specific network configuration is performed as part of the configuration process. In
order to locate this IP address which has been assigned to the machines virtual interface,
the command “ifconfig” is to be done which will reveal the address needed. It will be
located under the interface number under “inet addr:”.

15
Figure 3- Eth0 virtual interface IP
If no IP Address is revealed it means no interface has been initiated. To ensure the required
interfaces are up enter the command “if config eth(Num) up”. This will bring the required
interface up and using the command “dhclient eth(Num)” will ensure that an IP address is
given to it if it has not already been done.
Use this assigned address to advance to the web configurator distinct to PacketFence ZEN
by opening up a web browser and point to the address with the appended port number of
1443 in order to get started.
3.2.3.1 Issues with Virtualbox
In relation to testing done with PacketFence ZEN in Virtualbox, there were a few issues
which arose throughout the exercising of the application which caused negative effects on
performance. One which arose frequently was the inconsistency of files not being present in
their appropriate locations within the PacketFence appliance. This may have been caused by
file incompatibilities within Virtualbox from the PacketFence systemas it may not be as
suited to run the appliance as essentially necessary in order to exercise and access all of the
aspects of the ZEN solution. It is these locations which contain the information describing
the set-up of the specific systems VLANs and network interfaces which are crucially needed
to perform the required configuration capabilities to construct an adequate network setup.
PacketFence automatically fills the files related to the virtual interface with an IP Address
generated by the DHCP service provided by the solution. Throughout the testing of
Virtualbox it was this inconsistency of empty interface files which lead to problems
regarding network setup.
3.2.4 Phase Review
Through exercising of this phase the bases for which the demonstration can be developed
on should now be constructed. It was in this section that the network setup was decided

16
upon in regards to the enforcement type of the PacketFence application. The inline method
was chosen over the VLAN setup due to manageability of the project and the perspective of
which was considered more suitable for deployment. Testing with the VLAN out-of-band
enforcement method was attempted but concluded with no feasible results due to time
deficiencies and complications with the supported switch type. Once the Cisco 2960 switch
was configured with the necessary VLANs (registration, management, isolation, guest, MAC
authentication) the PacketFence server would not pick up the configured interfaces in which
they were set to. This is an aspect of the project which would be beneficial to review if it
were feasible to do so. As the VLAN enforcement is an effective feature of PacketFence, in a
way which really breaks down in detail the method of 802.1X port-based deployment.
3.3 Phase 2
This section of the testing and configuration of the PacketFence ZEN solution revolves
around further configuration and population of the network attributes and appropriate
interface files.
IP forwarding must be enabled on the PacketFence server within the CentOS operating
system. This is necessary so as to configure the OS with a router type feature, so that
packets that come in and out can be identified and sent on to the appropriate network
destination NIC or interface. This is enabled by the following commands:
#echo 1 > /etc/sysctl.conf/net/ipv4/ip_forwarding
Or an alternative way is to edit the file #/etc/sysctl.conf
And simply change net.ipv4.ip_forward = 1
To save this command you need to type:
#sysctl –p /etc/sysctl.conf
3.3.1 Web Configurator GUI
This phase concentrates on the actual configuration of the PacketFence ZEN environment
and the necessary elements needed in order to get the server up and running. The first step
being to open up a web browser and direct to the assigned IP address and the appropriate
port number of 1443, as discussed earlier. Once pointed to the specific address,
advancement will be made to the PacketFence web GUI in order to initiate further
configuration.
3.3.1.1 Enforcement Type
Once the web interface is reached the first step in configuration is choosing the specific
enforcement technique which best suites the environment or network architecture. For this
specific demonstration the Inline enforcement type was chosen in order to cater for the

17
entry level switch. VLAN enforcement is best suited if a manageable switch is obtained. It is
also acceptable to run both enforcement types if desired this is called Hybrid Enforcement.
Inline enforcement method uses “ipset” which is a framework inside the Linux kernel in
order to place nodes as registered, unregistered or isolated using stored IP addresses and
MAC addresses with an entry matching utility. This inline type of enforcement forces the
traffic from the inline network of the network environment through the management
network interface and out to the internet once network access is granted.
Figure 4-PacketFence enforcement type
3.3.1.2 Network Interfaces
The next step in configuration relates to the defining of the static network attributes for
each interface within the network. For this demonstration the management interface (eth0)
received the IP address “1.16” as given by the networks DHCP service. This interface will
work as the management side and will be used to communicate with the server and also to
NAT traffic from the inline network out. The inline interface of “eth1” was statically mapped
to the “2.0” subnet and given the IP address of “2.1” as a sample configuration. It is
important to make sure that this interface is defined as the inline interface when IP address
assigning is taking place. This is achievable by simple clicking the interface type on the GUI
once the “add VLAN” button is clicked next to the interface.
Figure 5- Networkinterface configuration

18
It is also necessary to enter in the default gateway for persistence to occur. This address will
be the gateway IP of the management network.
3.3.1.2.1 Manual Configuration
Although it is not always needed, it is possible to manually configure the interface
configuration files if problems occur within the GUI. This can be helpful for statically
configuring the IP of an interface as well as other critical attributes needed such as the
default gateway of the production network and whether they are set from initial application
launch.
3.3.1.2.1.1 Scripts
To manual configure the interface it is necessary to edit the network-scripts this can be
done by using the command:
Vi/etc/sysconfig/network-scripts/eth0
And
Vi/etc/sysconfig/network-scripts/eth1.1
And setting the configurations and values manually
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=DHCP
NETMASK=255.255.255.0
GATEWAY=192.168.1.254
And
DEVICE=eth1.1
ONBOOT=yes
BOOTPROTO=none
IPADDR= 192.168.2.1
NETMASK=255.255.255.0
GATEWAY=192.168.2.1
TYPE=Ethernet
Save the settings and restart the network service by using the command:

19
/etc/init.d/network restart
This method is usually unnecessary due to the PacketFence server’s capability to populate
the virtual interface on the management network. The web GUI is used to populate the
other interfaces within the environment but through testing it was defined that this
manually configuration can be useful.
3.3.1.3 Database Configuration
The next step is the setup of the MySQL server database account. This step is very straight
forward as PacketFence ZEN comes with a configured MySQL database so now download or
installation is unnecessary. This step will configure the MySQL server in regards to the user
name and password required for the database. Once that is decided upon it is important to
start and create the database account before the next step is available.
Figure 6-MySQL setup
3.3.1.4 PacketFence Configuration
The next step of configuration is based around the general options related to the
PacketFence installation. The general options are straight forward in terms of providing the

20
domain and hostname regarding the demonstration host device acting as the PacketFence
server, as a mechanism for being observable to foreign devices.
The DHCP servers section is to be populated with all of the DHCP servers on the
management or production network. This list is to be comma-delimited so as to divide the
server addresses. The purpose of this section is to establish all of the servers which are
related to the specific network and also for the reason that no rogue-DHCP servers are
picked up if they exist. For this demonstration the DHCP service is provided by the network
router on the management side.
Figure 7-General configurations
3.3.1.5 Administrator account creation
After the general configurations are set for the PacketFence environment, the next step is to
create the administration account. This is necessary so as to allow the admin to access the
PacketFence Administration web interface. It is as simple as providing a username and
password and creating the user via the “Create User” button.
3.3.1.6 Services Initiation
After the general configurations are set efficiently for the PacketFence environment, and
the administrator account has been created, the overall necessary configurations for the
demonstration should be completed. Clicking continue will provide advancement to the
PacketFence Services page where a list of the applications main functions will be present,
along with their current status (started or stopped). Clicking the “start PacketFence
services” button should initiate the specific starting services provided by PacketFence ZEN,
in which case the server shuld be up and running. If everything is configured appropriately

21
PacketFence will generate a message confirming the succession and prompting the user to
redirect to the admnistartion interface.
Figure 8-completed configuration
3.3.1.6.1 Service failure
The service confirmation interface lists all of the present PacketFence services and their
current status. This is beneficial as it helps locate which services have stopped or are not
working. Some of the main reasons for service failure during this projects prior
configurations were most notably related to the network and interface setup. Services such
as PacketFence DHCP cannot be established if the inline interface has not been created or
identified correctly, leading to service and overall configuration failure.
While exercising Virtualbox as the chosen hypervisor for this phase of the demonstration,
any case which lead to service failure lead to an overall crashing of the PacketFence
environment. These consistent failures brought each attempt at configuration to a halt, and
required for a new PacketFence ZEN image to be imported and for configuration to be
started from the beginning after every attempt.
If a failure persists while exercising the solution through VMWare products, a system
reconfigure is not necessary. If a service fails to start it is possible to identify why and where
by looking at the log output and identifying the failure, and from here help determine the
occurring problem.
/usr/local/pf/logs: vi error.log or pfconfig.log
3.3.2 Phase Review
This phase runs through the overall configuration of the PacketFence environment which is
necessary in order to customise the settings of the network environment in the specified
way. This phase presented many problems in regards to initial testing and attempts at
configuration. Most of the issues relating to the methods of virtualisation in terms of the
hypervisor used to run the PacketFence Solution. Virtualbox had its issues in regards to the
PacketFence services not initiating effectively and also network interfaces not being

22
populated as required. This in turn impacted negatively on this phase as it delayed the
creation of the PacketFence account and prohibited access to the administrator interface of
the demonstration. Through testing with VMWare player it was concluded that this was the
most appropriate method for completing phase two of the project demonstration.
3.4 Phase 3
3.4.1 Administration and testing
Phase three of the demonstration of PacketFence is based essentially around the testing of
the solution and the monitoring of the server as it recognises new devices, and deems users
as registered or unregistered. To access the administration web interface open a web
browser and go to the admin interface address, using the assigned IP of the management
interface along with the port number of 1443 i.e. https://192.168.1.16:1443/admin/login.
From there it is as simple as using the username and password credentials created in step 5
of configuration to log in and gain access to the administrator interface.
Figure 9- admin Login
3.4.1.1 Server Status
Once administration credentials are entered correctly, relocation to the administration
interface is performed. This interface immediately greets the admin with the essential
statistics regarding the PacketFence environment and server. It mainly displays information
regarding the frequency in registrations within the chosen timeframes and the overall
correlating server load.

23
Figure 10- PacketFence server output
The server load represents the activity levels within the PacketFence environment and
fluctuates up and down when specific actions are taken. Server load increases while manual
registrations take place due to the adding of nodes/devices to the MySQL database. Another
monitored status within the dashboard is the Available memory of the server. This relates to
the overall usage of the overall assigned memory capacity which was given to the
application during initial configuration within the virtual machine. This can be changed by
referring back to the memory configurations within VMWare player.
Figure 11- Memory
From the Status dashboard on the initial admin interface it is also possible to monitor the
total access requests/accepts and the corresponding frequencies related to the Radius
server. These graphs represent the relations between nodes or devices which are requesting
access to the network, and the corresponding action which was taken towards these nodes
in regards to admission or denial.
3.4.1.1.1 Monitoring services
From the status dashboard it is important that the provided services of the PacketFence
environment are monitored and initiated before any network access control protocols can
be put in motion. From this dashboard the specific services can be regulated in regards to
their current status and it is possible to start and stop particular services when desired or
necessary.

24
Figure 12-PacketFence services
To ensure that the devices which are requesting access are provided with an IP address, it is
important that the DHCP service is running at all times. This is necessary so as to
dynamically assign an IP address from the inline network subnet to the node as it is
connected to the switch on that side of the inline network.
Restarting the services can be of a beneficial value so as to refresh the server and make sure
all services are still functioning properly. This will determine whether the services start again
and whether they are in a positive state. Refreshing the “iptables” service can be of use as
sometimes they fail to update properly when a node has be granted access and stored as a
registered node.
3.4.1.2 Creating/adding nodes
Within the Administration GUI lies the interface regarding the networks relevant nodes or
devices. This section lists all devices which are discovered and connected to the specific
networks router within the environment. It is from here that PacketFence ZEN access and
registration process can be demonstrated and also tested.
The list shown in figure (13) is the nodes which are connected to the routers default
gateway which were discovered by the PacketFence server. Not all of these nodes are
influenced by PacketFence NAC capabilities, due to the fact that they are not connected
directly into the network architecture (i.e. switch, access point). However, PacketFence can
monitor the nodes in relation to stating the devices current status relevant to the network,
along with the MAC address needed for gaining the IP address and computer name from the
network. It also states the type of device in regards to whether it is a smartphone, gaming
console, laptop or storage device.

25
-
Figure 13-Network nodes/Device list
3.4.1.2.1 Testing of nodes
Within the list of nodes present on the demonstration network, the node which will be used
for testing and demonstrating of the PacketFence ZEN registration feature, will be the test
device named “Niamh-Laptop”. This device is the only node on the list which is directly
connected to the demonstration network environment via the entry level switch. It belongs
to the 192.168.137.0 subnet which is configured as the INLINE network within the
PacketFence setup. Its only gateway to the internet being from the INLINE network interface
through the management interface and out to the internet from there. Once access has
been authorized.
3.4.1.2.2 Actions against nodes
From the interface containing the list of nodes comes the bulk of the PacketFence ZEN
network access control capabilities. By ticking the box beside the desired node and entering
the “Action” dropdown box (fig 14), comes the list of action that can be taken against this
node/device, once it is connected to the demonstration network setup.
Figure 14-Node action list

26
The actions that can placed on a node include:
 Clearing a Violation which has been discovered or placed on a device. This can
include attributes such as requiring a systemscan, violating the specific bandwidth
limit, requiring of a Nessus or Open VAS scan.
 Registering of a device so that network access is granted.
 Deregistering of a device which was previously registered and was granted access to
the network through self-registration or through admin.
 Revaluating access which will determine the status of the device in regards to
gaining access to the network and determining why access has been denied if that is
the case.
 Applying a role to an undetermined device in relation to its state and what type of
access it requires. This can be determined by classing it as a gaming, default or guest
type role within the network.
 Applying a Violation to a node. This action allows the admin to apply a specific
violation attribute to a device if the admin requires or requests that node to pass a
specific policy before access can be granted. Or it can be just used as a routine
check-up on that node. Some of the violations of the systemthat can be manually
placed on a node include:
o A Nessus scan
o OpenVAS scan
o Rogue DHCP characteristic
o Wireless IPS
o A systemscan
o Time Expiration on network access
o A bandwidth limitation
3.4.1.2.2.1 Testing authorisation
In order to test the authorisation and registration actions against a node. An unregistered
device must be connected directly into the network setup via switch or access point. For this
demonstration the device “Niamh-Laptop” was used and connected into the entry level
switch. Once connected, the device was given an IP address within the 192.168.137.0 INLINE
network subnet. In most cases, this is configured automatically by PacketFence DHCP
service provided towards the INLINE interface. For this demonstration the IP was given
statically. However, the device does not have immediate access to the network or internet.
To test this, it is required that a browser is opened and pointed towards a HTTP site (i.e.
www.packetfence.org). If all goes accordingly the device should be relocated to the
PacketFence Registration page at the captive portal (192.18.1.16/captive-portal) (fig 15)

27
Figure 15-Registration notification
Figure 16-Registration Log in page

28
Figure 17-PacketFence Registration page
Once the device is relocated to the registration page this effectively means access to the
network is not permitted and the node is essentially unregistered within the network. The
username and password for testing the registration process is
Username: demouser
Password: demouser
(Packetfence.org, 2015)
If all goes accordingly within the captive portal, Redirection to the destination web page
should now be made and internet access is granted. This registration process is the main
feature regarding the testing of a PacketFence environment and acts as an efficient way to
test a feature of NAC by authentication. However, within this demonstration the captive
portal self-registration mechanism became problematic, and the only way to provide access
to a device was manually through the administrative web GUI.
To manually grant access to this device, it was necessary to redirect to the administrator
GUI. From there it was required to select the node and refer to the “Action” pane and click
the “Register” option. This will essentially register the device as a known node within the
network and the device then was granted access to the network and internet.
Figure 18-Device state
It was through this method that this feature of PacketFence was tested as a mechanism to
demonstrate its main registration and access feature.
3.4.1.2.2.1.1 Device self-registration
Throughout this demonstration problems arose in regards to the PacketFence device self-
registration aspect of the system. The problem being related to the registration process not
activating accordingly. When the user enters the username and password provided by
PacketFence the Login stalls and nothing appears to happen once the login button is clicked.
No further advancement is given to the user in regards to network access or a notification
message acknowledging the attempt at registration. Throughout testing, manual
registration of a node within the administration interface was the only method of providing
access to the device “Niamh-Laptop”. However, it is possible that admin accepting of the
node is required in any case post self-registration process by the device. With extended time
on the project further investigation into this aspect would be advised.
3.4.1.3 Creation/Registration of Nodes
It is also possible to create and register a device manually from the administrator GUI.
PacketFence allows for nodes to be created and registered straight away so that a particular

29
device can access the network without going through the registration process. Internet
access is granted immediately without need for authentication or authorisation.
This was tested using an alternative device named “KIERON-TOSH”. The purpose of this test
was to register this device by MAC address so that if it was to connect to the PacketFence
INLINE interface it would be registered and automatically gain internet access without need
for registration.
Figure 19- PacketFence Node creation
Regardless of the IP address this node is now seen as a registered device on the network
(fig).
Figure 20- Kieron laptop state
As a means of testing this procedure, “KIERON-TOSH” was connected to the INLINE network
of the demonstration environment. It was then necessary to reset its IP address given to it
via DHCP by the management network, and set it to obtaining an IP address via Ethernet on
the INLINE subnet on the PacketFence INLINE interface.
Once connected, the device was given immediate access to the internet. This was due to the
fact that the device had already been created and registered, prior to the node being
connected and seen as a foreign device within the PacketFence network. This is feasible due

30
to the MAC authentication. Once the device is connected to the switch port, the device was
given the IP address of 192.168.137.144. Statically setting the IP of the laptop to an IP on
that subnet is necessary if DHCP failure occurs by PacketFence. PacketFence then identifies
that the node comes with a corresponding MAC address which has been registered within
the system from the “iptables”. So access to the network and internet is achieved for the
device. There is also a un-registration date set as a mechanism to deregister a user. This
provides the admin with more control over the network and generates a more manageable
grasp over the devices which are registered within the network.
3.4.1.4 Configuration Interface
PacketFence ZEN also comes with a very flexible and efficient configuration interface. It is
from here that the administrator can go over all of the configurations of the PacketFence
environment, in a way which caters for an effective and personal grasp over the security
methods and policies desired for the network.
3.4.1.4.1 Main Configurations
General configurations within the PacketFence administration Web interface are plentiful.
They are designed in a way which presents the administrator with a way to fine grain every
aspect of the way in which devices are treated and in what way network access control is
managed.
Configurations can be made to prior setups made through the initial phases of the
PacketFence installation. These can relate to DHCP server information, made alterable in the
case that new servers are added on larger scale production environments. From the
configuration interface the specific services of PacketFence can be altered on or off as well
as simple altercation within the self-registration page, in relation to what text is displayed
on the “registration” button (fig 21).
Figure 21- Captive portal configurations
In order to save memory and ensure that there is no back up of inactive nodes on the
server, there is an expiration configuration within PacketFence. This configuration allows for
the admin to generate a specific time allocation for which a node will remain on the server
while it has been idle from use (fig 22).

31
Figure 22- node expiration configurator
Setting the expiration to a reasonable amount of time is beneficial as it releases server
memory and load from inactive or unused nodes and users from the system. Setting an
expiration on IP/MAC logs is also of importance as irrelevant data in regards to these
addresses is invalid within the server, once considered inactive by the time allocation.
3.4.1.4.2 Network Configurations
The network configuration interface is also an element within the administrative GUI. This
section of configuration is massively important as it allows for the alteration of network
interfaces within the PacketFence network setup. During this demonstration it was
imperative that new interfaces were created in order to do significant testing of both
management and INLINE networks.
Figure 23-Interface and network configurations
From this section it was possible to reconfigure old and new interfaces to cater for different
connections. Deciding which interfaces are set active or not is also key as it determines
which interface the devices connect to. So essentially, the ability to alter and change these
aspects are crucial. From this element of configuration, PacketFence excels as it really

32
provides total control over the specific network leaving no gaps for error in relation to
connections.
There is also a section for managing the specific switches local to the network setup.
Providing a mechanism to describe whether a switch is set as a production switch or merely
for testing. This however, was not needed for this demonstration as a manageable switch
was not utilised. An aspect which would have been considered beneficial to examine if
further testing could have been achieved. As the VLAN deployment type setup is a major
aspect of the 802.1X port-based enforcement method of Network access control, that
PacketFence excels with.
3.4.2 Phase Review
This phase of the demonstration of PacketFence ZEN contributed to the final testing stages
of the application and provided an insight into some of the features available within the ZEN
version. It also provided insight into how the server operated when workload was generated
and functions were put into use.
3.4.2.1 Issues with phase 3 and aspects of further investigation
Within the final stages of the implementation perspective of the project, there were in fact
applications that were not exercised as effectively as initially planned. Some of the issues
regarding aspects of phase 3 and the overall functionality of the PacketFence that arose
were most notably in relation to the quality checks provided by the solution. These are
features that although were present within the demonstration could not be demonstrated
as effectively as initially intended for various reasons which will be touched on.
3.4.2.1.1 Perform Scan
One of PacketFence main features is to perform a vulnerability checks in the form a Nessus
or OpenVAS scan on newly registered devices or manually by selection of the scan option.
Nessus is essentially a vulnerability scanner software developed by Tenable Network
Security (Tenable, 2015). Its main feature local to PacketFence being to perform scan
operations on newly registered devices to determine whether the guest has a specific
vulnerability which needs to be rectified. This operation failed to establish whilst testing was
made on registered devices within this projects implementation of PacketFence ZEN.
The errors that occurred when scans were selected to be performed on nodes within the
server’s databases were established by frequent errors regarding the Apache server within
the PacketFence system. Displaying a message noting that the server certificate could not be
registered and that a new certificate was to be regenerated. A parameter also restricting a
scan was a warning in relation to the captive portal failing to start. This may be related to
the issue regarding the captive portal login. This is a feature that was hoped to be exercised
within this demonstration from the initial prototype. Nessus vulnerability scans are an
effective attribute within this solution, and practice of this concept would have been an
effective attribute in portraying an essential feature of network access control.

33
3.4.2.1.2 Remediation
One of the features of PacketFence which demonstrates a key element of security within a
NAC consistent network is the application of remediation. Remediation of a device is the
process of placing that node within the required location or URL necessary in regards to the
status of the device. PacketFence uses a captive portal method in which the user is placed in
the appropriate location based on the current status of the device in relation to violations
obtained by the node or policy infringements. In any case, network traffic is terminated and
the offending device is redirected to a page from which they will be informed of the
problem and be notified in a way which represents a method of rectifying it.
Within this demonstration this feature was not managed to be exercised. The device still
manages to redirect to the URL in which it originally intended to visit. Once a violation is
placed on a device from the management interface the device still negates this statement
and avoids the captive portal URL in which they are intended to visit. Only unregistering of a
device can prevent a device from reaching its destination. Reasons for this problem could
relate to specific browser types chosen for demonstration or the issue regarding the captive
portal mechanism not functioning as intended. From further research it was defined that
some browser types preferably redirect the device to the chosen URL without compromise
from the captive portal remediation page. An issue that would be revised if more time had
been presented. It is also possible that the INLINE setup is not as compatible to handle
remediation properties related to the captive portal. This issue could be related to the fact
that there is not a separate VLAN to remediate devices to once violations occur in the shape
of a zone of quarantine, as INLINE setup is merely a basic setup in order to test the
registration properties within PacketFence ZEN with an unmanageable switch type.
3.5 PacketFence ZEN review
In regards to the overall outcome in relation to testing of whether PacketFence ZEN is a
suitable solution for demonstrating NAC, the results have varied. In general, the fact that
PacketFence is free, open sourced and fully supported makes it a great application to
demonstrate the topic of network access control. Its ability to perform registration and
remediation is a critical element in regards to portraying important features typical of a NAC
solution. Its capability to perform compliance and health scans and checks makes it a good
solution for determining the state of a networks access by devices.
From this demonstration and overall study of the solution, it was determined that
PacketFence does indeed flourish in its features. However, it is important to state that the
solution would not be deemed an adequate testing mechanism in terms of ease of use and
deployment. Configuration of PacketFence was, and can be challenging in relation to overall
setup. It can be confusing to deploy due to the fact that there is no “straight forward”
method or approach to setting it up. This is due to the differentiation of the different
network setups and architectures by which PacketFence can be deployed to. From this
demonstration it was easy to determine that the setup required vast amounts of trial and

34
error in regards to network architecture, the required equipment and the virtual machine
configuration. However, once the steps regarding configuration are complete, it was clear
that PacketFence portrays an excessively controllable administration interface. From
exercising the Administrative aspect of the solution, it was clear to see that the application
carries a well manageable and impressive administrative element. In which the
administrative user truly has essential controlling capabilities and feasible grasp over the
overviewed Network and devices from a manageable point of view.
The functionality that was demonstrated in regards to the registration feature of devices
within a network was of most importance. Although, not as simple to set up as so deemed
by the PacketFence administration guide, once configured the feature adequately conveys a
key element of Network Access Control. Which through this demonstration and exercising
of the product it was clear to define that on a larger scale deployment, the fully featured
version of PacketFence would truly be an impressive component in relation to NAC.
3.6 Other Technologies
Another element which is of importance to gain an understanding with, is the aspect related
to gateway deployed network access control. As a good perception regarding this area is
important in order to truly grasp an adequate understanding of NAC as a whole. Check Point
security gateway solutions act as a prime example of how gateway-based network access
control is defined, configured and utilised. In a way which through a short investigative
insight, a better understanding of this methodology can be acquired.
3.6.1 Check Point Security Gateway
Check Point technologies have been a substantial contributor as a security provider over the
last two decades, protecting customers from a consistently altering online threat
environment (Point, 2014). One of the most notable products of the company is their
Security Gateway appliances which have been a leading mechanism for defending against
unwanted access and web-borne malware. The method of this solution is based around two
NAC products (R65 and R70) that once acquired provides for all the elements needed to
enable gateway-based network access control. From the use of Cooperative enforcement,
CP security gateway uses firewalls primarily as a point of enforcement to quarantine and
remediate users that violate gateway policies. Which differs from PacketFence VLAN
enforcement due to the fact that PacketFence out-of-band deployment is a port defined
NAC solution. This Gateway-based solution works similarly to PacketFence in relation to its
method of dealing with devices. Check Point software also uses a Captive Portal by which
hosts are notified about their current status in regards to gaining access to the network.

35
Figure 24- Check Point captive portal (Point, 2014)
Hosts that fall out of policy or compliance with the network can be disconnected, restricted,
remediated and quarantined much like the process by which PacketFence deals with devices
which fall out of compliance with the network. The solution allows for users which fall out of
compliance to correct the violations if possible, in which case the restrictions are lifted and
the host is relocated from the quarantine network. Check Point Security Gateway NAC also
allows for administrative management over the methods by which policies and firewalls are
enforced, so as to allow the network to be secured with as much protection as required, in a
manner which suites the needs of that specific network.
3.6.1.1 Configuration
In regards to configuration of this solution, it is completed in 3 easy steps so as to get
Network access control up and running. Cooperative enforcement is a critical element to
this type of enforcement so it must be enabled on the Check Point security gateway. This is
achievable by initialising the SmartDashboard application and logging in to the SmartCenter
(Cygnia.co.uk, July 2, 2009) which is a user data centre log in purchasable from Check Point
Technologies. From the same GUI the security policies and firewalls which are to be applied
to the network are chosen and installed from a policy drop down box.
The last step of the configuration of the Security Gateway application is to navigate to the
Endpoint Security server and redirect to the gateway Manager and define the actual
gateway by which policies will be enforced.

36
Figure 25-Check Point gateway manager (Cygnia.co.uk, July 2, 2009)
Once the gateway has been chosen the final step is to enforce a rule upon the Check Point
gateway. Policies are implemented via the “enforcement settings” tab and it is as simple as
defining the rule name and specifying the conditions. The conditions usually being to check
for a registry key and value or a specific file name that must be obtained in order to gain
access to the network. Save the rule and it is now added as an enforcement policy upon the
gateway in which hosts will be looking for access to. It is a quick and easy method for
organisations to add gateway NAC to their network.
3.6.1.2 Simple Test
Check Point NAC software is not free to use, but they provide a mechanism to test some of
their software via 30 day trial. The Check Point threat emulation software blade is an
application which emulates a software and file policy check, which can be utilised as a
mechanism of NAC in a way which acts as a compliance check for endpoints. The purpose of
such an application is to prevent infections from undiscovered exploits and zero-day
targeted attacks. The test works by uploading a file of any type to the Check Point cloud and
from here the file is analysed for threats or malware. If purchased the software will perform
these scans at the Check Point gateway as a mechanism to enforce network access control
in the form of a malware check policy. When the file is uploaded it is opened, run and
analysed by a threat emulation sandbox and monitored for suspicious behaviour.
Figure 26-Check Point software emulation process (technologies, 2015)

37
From there it is determined whether the file is infected or malicious in any sort of aspect by
the threat emulation software. Once monitoring of the file is completed the user is provided
with a downloadable report in which information about the file is given, if infected the user
will be informed of malicious activity within this report. If the file is infected, Threat
extraction software will be used to remove infected attributes such as macros and
embedded objects (technologies, 2015). The file is then returned to the user from the cloud
or gateway free of malicious content and completely safe to download.
Figure 27- report screenshots
From the report it was clear to see that there was no malicious content found within the
file, by the threat emulation software. So compliance would have been present and the
parameter or policy would have been adhered to in relation to gaining access to the
network.
3.6.2 Review
In relation to the method by which gateway deployed NAC is implemented, it was clear to
see that once the proper hardware is acquired the Check Point security gateway solution
could be deployed quickly and efficiently. The method by which firewalls are used to query
devices and act as the point of enforcement is efficient as an approach to integrating NAC.
The solution acts as a sufficient way to add to an organisations existing secure Network
architecture.
4 Conclusion
This projects main purpose Is to provide an insight into network access control as a
mechanism for applying a degree of security to a networks access and resources. From
research and exercising of the topic it was clear to state that NAC can provide an
organisation or business with durable, well managed control over a networks access to
endpoint devices. Regardless what method is chosen to deploy NAC, both gateway and port-

38
based implementations have their strong points and mechanisms to ensure security over a
networks access.
4.1 Implementation Review
4.1.1 Phase 1
Phase one of implementation provided an insight into developing the necessary foundations
for initial deployment of the NAC solution. It regarded the foundations for the network
architecture used for the demonstration and knowledge into the initial downloading and
setup of the virtual machine and the PacketFence appliance. As well as possible alternative
methods by which the demonstration could be exercised.
4.1.2 Phase 2
Phase two of implementation was based around the essential configurations needed to get
the PacketFence server up and running. It provides an insight into initial commands needed
for the CentOS operating system as well as a guide into how the PacketFence environment
was established.
4.1.3 Phase 3
Phase three of implementation was most notably based around monitoring of the
PacketFence environment and providing an insight and evaluation of the solution through
the administrative aspect of the environment. Testing and evaluation of the registration
feature of the solution was also exercised as well as the creation and monitoring of devices
which were connected to the network.
4.1.4 Other Technologies
This section comprised of a brief investigation into an alternative solution for providing
gateway-based network access control. It provided an insight on the Check Point Security
Gateway solution and assessed the method by which configuration and features are
integrated on such a solution.
4.2 Limitations
PacketFence ZEN was the application used in order to demonstrate the topic of Network
Access control. Limitations regarding the implementation of NAC in a lab environment
revolve around the method by which the solution of PacketFence was deployed. The Inline
enforcement type of PacketFence ZEN limits the demonstration to registration and
deregistration of a device upon the network. It was possible to apply violations to devices
which in turn would block traffic from that device to the network, but with no capable way
for the device to reprimand the specified violation. Remediation to an alternative network
was also a limitation as the inline enforcement may not support this feature. This being due
to no alternative VLAN to redirect the device which has fallen out with compliance.
PacketFence as a solution is a challenging application to implement on to any network. With
production time frames usually taking months to integrate. Insufficient time has acted as a

39
limitation in regards to exercising and configuring some of PacketFences other NAC features
such as performance scans and remediation due to violations.
4.3 Recommendations
Recommendations for this project most notably apply to the way in which the
demonstration was configured. VLAN enforcement as the initial method of enforcement
would be the main element to be considered if future exercising of the solution
commenced. This being due to this type of enforcement being a better method by which the
solution could be tested. VLAN enforcement would allow for more features to be examined
due to the fact that more ports would be available to demonstrate aspects such as
remediation, MAC detection, isolation, quarantine etc. In relation to hardware a cisco
manageable switch should be considered as this would allow for more control over the
specific states devices would enter, and also allow for SNMP traps and enhanced port
security.

40
5 References
Cygnia.co.uk, July 2, 2009. www.cygnia.co.uk. [Online]
Available at:
http://www.cygnia.co.uk/content/whitePapers/Check%20Point/CheckPointget-nac-up-and-
running.pdf
Packetfence.org, 2015. PacketFence ZEN Inine enforcement configuration guide. [Online]
Available at:
http://www.packetfence.org/downloads/PacketFence/doc/PacketFence_Inline_Deploymen
t_Quick_Guide_ZEN-5.1.0.pdf
PacketFence, 2015. www.packetfence.org. [Online]
Available at: www.packetfence.org
Point, C., 2014. www.CheckPoint.com. [Online]
Available at: https://www.checkpoint.com/downloads/product-related/datasheets/SWG-
appliance-datasheet.pdf
technologies, C. P. S., 2015. Check Point threat emulation software blade. [Online]
Available at: https://threatemulation.checkpoint.com/teb/upload.jsp
Tenable, 2015. www.tenable.com. [Online]
Available at: http://www.tenable.com/products/nessus-vulnerability-scanner

41
Appendix
Table of Figures
Figure 1- NAC remediation.........................................................................................................8
Figure 2- VMWare player adapter settings..............................................................................14
Figure 3- Eth0 virtual interface IP ............................................................................................15
Figure 4-PacketFence enforcement type.................................................................................17
Figure 5- Network interface configuration ..............................................................................17
Figure 6-MySQL setup..............................................................................................................19
Figure 7-General configurations ..............................................................................................20
Figure 8-completed configuration ...........................................................................................21
Figure 9- admin Login...............................................................................................................22
Figure 10- PacketFence server output.....................................................................................23
Figure 11- Memory ..................................................................................................................23
Figure 12-PacketFence services...............................................................................................24
Figure 13-Network nodes/Device list......................................................................................25
Figure 14-Node action list........................................................................................................25
Figure 15-Registration notification..........................................................................................27
Figure 16-Registration Log in page ..........................................................................................27
Figure 17-PacketFence Registration page................................................................................28
Figure 18-Device state.............................................................................................................28
Figure 19- PacketFence Node creation....................................................................................29
Figure 20- Kieron laptop state .................................................................................................29
Figure 21- Captive portal configurations .................................................................................30
Figure 22- node expiration configurator..................................................................................31
Figure 23-Interface and network configurations.....................................................................31
Figure 24- Check Point captive portal (Point, 2014) ................................................................35
Figure 25-Check Point gateway manager (Cygnia.co.uk, July 2, 2009) ...................................36
Figure 26-Check Point software emulation process (technologies, 2015)..............................36
Figure 27- report screenshots..................................................................................................37

Network Access Control as a Network Security Solution

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Network Access Control as a Network Security Solution

Similar to Network Access Control as a Network Security Solution (20)

Network Access Control as a Network Security Solution