Exclusive: ConSentry keeps a watchful eye on users

For users such as contractors or business partners who need to access the network but aren’t part of the local user authentication system, ConSentry provides a Web-based system called Captive Portal. Basically a catch-all log-on system, Captive Portal authenticates against a RADIUS server and helps maintain control of users not directly managed or maintained in the enterprise directory. This allows IT to create a “visitor” profile and set of policies to manage these users directly.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld ConSentry CS2400 Secure LAN Controller ConSentry Networks, consentry.com Excellent  9.3 criteria score weight Policy Enforcement 10 25% Policy Management 9 20% Reporting 9 20% Scalability 9 15% Ease-of-use 9 10% Value 9 10% Cost: $17,995 for CS1000; $27,995 for CS2400 Platforms: Any 10/100/1,000Mbps Ethernet network and TCP/IP Bottom Line: Controller does double duty by enforcing network access control policies on enterprise users and also by capturing and decoding packets through Layer 7. This awesome visibility gives security admins the tools to craft very broad -- or very granular -- user access policies based on application, port, group affiliation, or any combination of these. The Secure LAN Controller does not do any host checking or validation but will work with most third-party platforms, including Cisco Trust Agent. As long as all user traffic passes through one of its ports, the Secure LAN Controller will keep a close eye on user behavior. About our Reviews and Scoring Methodology

In the event that a user does not successfully authenticate, depending on the ConSentry policy, the Secure LAN Controller can deny the user access to all network resources or allow access to specific resources. For example, a user who fails to log in might be redirected to an informational page for remediation or simply allowed to browse the Internet and nothing else.

Hands off

To accomplish this level of user control, IT must decide either to install additional hardware in the wiring closet or to deploy a software agent to all enterprise users. Another high-end user access control system, Elemental Compliance System, relies on a client-side agent for policy enforcement. All of ConSentry’s enforcement is done in the Secure LAN Controller without any need to install and maintain a software agent on the client PCs.

Unlike Elemental, ConSentry cannot perform any host-compliancy checks as part of its policy enforcement, because it doesn’t directly interact with the host device. It does, however, work with any third-party system, such as Cisco’s Trust Agent -- part of the Cisco NAC (Network Admission Control)  initiative and the Trusted Computing Group agent specification.

This best-of-breed approach allows ConSentry to fit into already established host compliance systems while making the best use of the information gathered from the hosts. The company plans to provide a clientless host-checking solution in the near future to handle devices that do not have an agent installed.

One advantage the ConSentry solution has over the Elemental Compliance System is that it is hardware agnostic. It will enforce access policies on users whether they are on PCs, PDAs, smart phones, or other non-traditional network devices.

A view from the top

Policy creation is done via the ConSentry InSight Management System. This Java-based tool runs on a Windows PC and can manage as many as 10 Secure LAN Controllers. With the current release, only global policies can be set through InSight. Security admins must use the command line interface to create and manage individual user and group policies. The CLI is reminiscent of Cisco Internetwork Operating System, so text junkies will feel right at home.

It is through InSight that admins have user application visibility. Each user session is exposed to the admin including application, destination, and session information. During my tests, I was able to see that a user was accessing a peer-to-peer application, how long he was connected, how many bytes had been transferred, which mail servers he was connected to, and how many e-mails per minute he was sending. The amount of information logged was staggering and provides the kind of digital forensics necessary to identify misuse of network resources.

The ConSentry Secure LAN Controller is a terrific piece of hardware backed by a good management platform. As long as all of your user traffic passes through the controller, policy enforcement is rock solid. It won’t, however, help out in local workgroup situations, so plan your deployment accordingly and ConSentry will handle the rest. But for true real-time visibility into network traffic, the Secure LAN Controller can’t be beat.