1. INDIANAUNIVERSITYINDIANAUNIVERSITY Indiana University Update Tom Zeller zeller@indiana.edu

2. INDIANAUNIVERSITYINDIANAUNIVERSITY First an Ad for NetGuru Meets immediately after I2 Joint Techs Focuses on large campus network issues Email me at zeller@indiana.eduzeller@indiana.edu

3. INDIANAUNIVERSITYINDIANAUNIVERSITY Governance Completed 10 year Strategic Plan Beginning new 10 yr Strategic Plan

4. INDIANAUNIVERSITYINDIANAUNIVERSITY Governance Completed 10 yr tactical Telecom Plan – Business model considerations – Network edges in surges for new features – Dorm wiring left to natural refurb cycle – $$ for network security on ongoing basis

5. INDIANAUNIVERSITYINDIANAUNIVERSITY Projects WiFi RFP completed. Upgrade over summer Implementing MPLS – PCI first target

6. INDIANAUNIVERSITYINDIANAUNIVERSITY Isolating and Protecting Devices on the Network A database-driven methodology Tom Zeller June 2008

7. INDIANAUNIVERSITYINDIANAUNIVERSITY Purpose Automatically detect special categories of devices and create an appropriate network environment for them

8. INDIANAUNIVERSITYINDIANAUNIVERSITY Methodology Overview 802.1x on wired and wireless For non-802.1x devices switch proxies using MAC address as username and pw Custom RADIUS server recognized username is a MAC address looks up policy

9. INDIANAUNIVERSITYINDIANAUNIVERSITY Define Device Categories Work with departments Categories should be easily added Examples: – PCI cash register – Security Camera – Stolen Laptop – RoboDog – Many more

10. INDIANAUNIVERSITYINDIANAUNIVERSITY Define Policy Action for Each Category VLAN ID Port ACL Access Denied Alert someone (e.g. stolen laptops) Allow only if in a particular building Allow only if network type matches

11. INDIANAUNIVERSITYINDIANAUNIVERSITY MAC Table Input Web application with granular access to categories – e.g. Only physical plant admins can add cameras API for IDS, scanners, etc to add devices on fly Include date for annual refresh Force building restriction for most categories Restrict to wired or wireless only (or both)

12. INDIANAUNIVERSITYINDIANAUNIVERSITY Device, Category/Action Tables

13. INDIANAUNIVERSITYINDIANAUNIVERSITY Link VLAN names to VLAN Numbers VLAN “Quarantine” is different number in different locations

14. INDIANAUNIVERSITYINDIANAUNIVERSITY RADIUS Logic If username is a MAC address – Don’t authenticate via ADS – Look up in registered device table – If present retrieve policy action and building – If building matches requesting switch Send policy via RADIUS attributes to switch

15. INDIANAUNIVERSITYINDIANAUNIVERSITY Transparency: The Solution to Complexity Develop web application to allow support personnel to enter MAC address and see what SHOULD have happened (category, building, VLAN, ACL) and/or what ACTUALLY happened (from log file)

16. INDIANAUNIVERSITYINDIANAUNIVERSITY Need to investigate Trusted Computing Group – Trusted Connect Group – New IF-MAP standard for NW database – Input from multiple sources – Info subscribed by network device Consider intersection between device and user, if any

17. INDIANAUNIVERSITYINDIANAUNIVERSITY Indiana University Update Tom Zeller zeller@indiana.edu