?
Solved

Setting up policy based networking on an NT domain

Posted on 2004-08-17
5
Medium Priority
?
277 Views
Last Modified: 2010-04-11
I have been tasked with researching possible ways to setup a policy based network.  Our network is seeing more and more corporate visitors and currently they are given an ethernet cable and off they went.  We are on an NT domain that is locked down quite tightly, however would like to take it a step further by limiting guest access to port 80 only (possibly 110, 25, etc) no matter what physical port they are connected with.  Eventually, I would also like to be able to restrict network access even for authenticated users that do not have current virus DAT files.  However, that's down the pipe yet.  

Thanks for the suggestions,

Mike
0
Comment
Question by:mgrass
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 15

Expert Comment

by:adamdrayer
ID: 11826523
are you using a switch?  a firewall? what model?
0
 
LVL 15

Accepted Solution

by:
adamdrayer earned 1500 total points
ID: 11826529
0
 
LVL 1

Author Comment

by:mgrass
ID: 11827183
I'm running three Dell PowerConnect 3348s for switches and a Linux based firewall.  I have used ISA 2000 in the past but wasn't happy with it.  I've loaded up ISA 2004 from my MSDN subscription on an older workstation box to play with, but haven't had the time.  If I recall correctly, it was the proxy portion of ISA that bothered me the most.
0
 
LVL 1

Expert Comment

by:Jachin
ID: 11828584
I'm not sure what the 3348s can do but one solution would be to place another firewall between all the client machines and your servers. This way you can only allow port 80 through and nothing else.

If you had cisco switches you could also configure Vlans for your servers and then setup access lists on your router to only allow certain traffic between vlans.

Perhaps it would be worth holding off a while until Cisco get their new products out. They are working towards Layer 2 authentication. So as soon as you plug a device into a port on a switch you need to provide some credentials before you even get a physical link. Then you can have the deviced moved into a separate VLan if the antivirus isn't up to date.

Cisco call it self-defending networks. http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns413/networking_solutions_package.html
0
 
LVL 15

Expert Comment

by:adamdrayer
ID: 11829194

the problem is that you would like to control access based on windows user account.  I don't know if ISA can do this, but if it can, I bet it's the only solution.  After the DC authenticates your session, all internet traffic travels directly to your gateway/firewall.  This means that it doesn't really pass through any hardware that can test for credentials.  ISA server being a microsoft product has Active-Directory Integration and LDAP-connectivity, so I assume you would be able to do it that way, but I'm not positive.

Any other solution would involve a physical or logical seperation of computers from the rest of the domain.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Suggested Courses
Course of the Month11 days, 20 hours left to enroll

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question