Juniper links its NAC, IDP platforms

Microsoft Vista support added to network-access control

Juniper Networks is linking its intrusion-detection platforms to its NAC gear, making it possible to restrict devices that manage to gain network access by passing health checks but then pose a threat once they are on.

With a new version of its Unified Access Control (UAC) software -- Juniper's name for NAC -- data gathered from the company's Intrusion Detection and Prevention (IDP) platforms can trigger its UAC gear to block potentially malicious traffic at its source. Operating alone, IDP drops suspect packets, but doesn't deal with where they come from.

This integration gives Juniper a flavor of postadmission NAC by supplying its UAC Infranet Controller with data about application traffic. The controller can correlate the anomalies and threats IDP finds with specific users. Then it can apply policies to mitigate threats. So if a device is the source of a threat, it can be quarantined or have malicious sessions cut off. If the event is less severe, the controller can just log it.

Before, the NAC gear simply wouldn't know about threats found by IDP.

Enterasys integrated its IDP with its intrusion-detection gar in January, and other NAC vendors, such as ConSentry, ForeScout, Insightix and Tipping Point, already offer postadmission NAC.

The new software supports only integration with Juniper's IDP, so customers with IDP gear from another vendor don't gain from this feature, says Andrew Braunberg, an analyst with Current Analysis. He says demand from customers may ultimately push the company toward third-party integration.

Juniper is also announcing that it has a version of its UAC client software that operates with the Microsoft Vista operating system. Previously, it worked with Windows XP and Windows 2000. Braunberg says this does not mean the network-access protection (NAP) client -- Microsoft's name for NAC -- that is built into Vista can substitute for Juniper's UAC client. So customers cannot avoid deploying a separate client if they use UAC.

The new UAC software supports automatically fixing shortcomings in Windows machines that are found out of compliance with the access policies UAC enforces. So if certain files are missing from the machines or certain processes are turned off, the Infranet Controller can fetch them or turn them on. Before, in all cases, if a machine failed its health check, the user had to manually update it.

Along with this, the software can find out more than before about the security posture of the endpoints it checks out. To do this, Juniper is incorporating Shavlik NetChk software in its platform to more thoroughly assess a wide variety of security patches.

All these new features come with UAC 2.1, which is available at the end of the month.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Tim Greene

Tim Greene

Network World (US online)
Show Comments

Essentials

Brother MFC-L3745CDW Colour Laser Multifunction

Learn more >

Mobile

Exec

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?