Hi,
Looking for some advice on Implementing NAC across the enterprise. The environment uses laptops, desktops and thin-clients (Vmware VIEW, VDI) which connect to ESX servers where the actual machines reside (running Windows 7 and Windows XP operating systems).
So the question is can I use NAC server to posture assess/authenticate the thin-clients users?
This is what I am thinking:
· NAC – OOB would not be supported in this design since the ESX connection to the switch would be a trunk link. Also the thin-client connection to the switch also always stays up.
· NAC – Inband would be supported but could potentially be a bottle neck because the customer has a 10 gig backbone network.
I am thinking if I can use two different NAC appliances as part of the solution.
· Use one appliance in Inband mode and use it for the ESX servers. Use the profiler to exempt the thin-clients from authentication since they basically have nothing running on them and they cannot authenticate to the NAC server.
· The second NAC appliance will be configured as Out of Band and all the remaining regular users (with physical laptops, desktops) gets authenticated to this NAC server.
This way the NAC bottleneck would only be limited to the thin-clients users who connect to the VM’s running on the ESX server.
Is this a viable option for NAC’ing the VM clients running on ESX servers.
