EASY NAC CGX ACCESS DEPLOYMENT GUIDE Installation and Configuration Guide Easy NAC, CGX Access, and vLinks are trademarks of InfoExpress, Inc. Other product and service names are trademarks and service marks of their respective owners. www.infoexpress.com www.easynac.com V3.0 210202 Easy NAC: CGX Access Guide 1 Contents Overview ....................................................................................................................................................................... 7 Appliance Licensing Options ............................................................................................................................... 9 Appliance Specifications ...................................................................................................................................... 9 VM installation ........................................................................................................................................................... 10 Installing on ESX or ESXi server ........................................................................................................................... 10 Installing on Hyper-V server .................................................................................................................................. 11 Configuring CGX Access ........................................................................................................................................... 14 Appliance Placement .............................................................................................................................................. 14 Initial configuration ................................................................................................................................................ 14 Basic IP configuration ........................................................................................................................................ 14 Captive Portal IP Address .................................................................................................................................. 16 Remediation Portal IP Address .......................................................................................................................... 16 Connecting to Active Directory ......................................................................................................................... 16 AD Integration ................................................................................................................................................... 18 Configuring Email and SMS Servers ................................................................................................................. 19 Protecting Additional Subnets ................................................................................................................................ 21 Adding Network Adapters ................................................................................................................................. 21 Using 802.1q trunk ports .................................................................................................................................... 22 Additional 802.1q configuration in VMware ESX / ESXi................................................................................. 23 Additional 802.1q configuration in Hyper-V server .......................................................................................... 24 Enforcement Overview ........................................................................................................................................... 29 Configuring Access Policies................................................................................................................................... 30 Automated Device Classification Policies ......................................................................................................... 30 Access Group (ACLs) ........................................................................................................................................ 33 ACL Examples ................................................................................................................................................... 34 ACL Syntax........................................................................................................................................................ 35 Flagging Devices and Whitelisting ........................................................................................................................ 37 Flags ................................................................................................................................................................... 37 Whitelisting \ Blacklisting ................................................................................................................................. 39 Anti-spoofing Protection ........................................................................................................................................ 41 Setting Fingerprints ............................................................................................................................................ 41 MAC Spoofing Detection .................................................................................................................................. 43 Rogue DHCP Server Detection .......................................................................................................................... 43 Time \ Location \ List Policies ............................................................................................................................... 45 Location Policy .................................................................................................................................................. 45 Time Policy ........................................................................................................................................................ 46 Device-Lists Policy ............................................................................................................................................ 47 Easy NAC: CGX Access Guide 2 Configuring Guest Access .......................................................................................................................................... 49 Customize Captive Portal ....................................................................................................................................... 49 Customize Guest Portal .......................................................................................................................................... 49 Guest Registration Templates ................................................................................................................................. 53 Customizing Device Registration Templates for Guests ........................................................................................ 53 Setting up Sponsors ................................................................................................................................................ 57 Sponsoring Users .................................................................................................................................................... 58 Configuring Device Registration ................................................................................................................................ 59 Customizing the Device Registration portal ........................................................................................................... 59 Confirm Active Directory settings ......................................................................................................................... 59 Customizing Device Registration Methods ............................................................................................................ 61 User Experience ..................................................................................................................................................... 63 Integration: Anti-Virus \ Endpoint Management ........................................................................................................ 64 Bitdefender Integration ........................................................................................................................................... 65 Carbon Black Cb Response Integration ................................................................................................................. 68 ESET Antivirus Integration .................................................................................................................................... 71 IBM BigFix Integration .......................................................................................................................................... 73 Ivanti Security Controls .......................................................................................................................................... 75 Kaseya VSA Integration ......................................................................................................................................... 77 Kaspersky Antivirus Integration ............................................................................................................................. 79 ManageEngine Desktop Central Integration .........................................................................................................