Networking

Juniper Networks is linking its intrusion-detection platforms to its NAC gear, making it possible to restrict devices that manage to gain network access by passing health checks but then pose a threat once they are on.

With a new version of its Unified Access Control (UAC) software -- Juniper's name for NAC -- data gathered from the company's Intrusion Detection and Prevention (IDP) platforms can trigger its UAC gear to block potentially malicious traffic at its source. Operating alone, IDP drops suspect packets, but doesn't deal with where they come from.

This integration gives Juniper a flavor of postadmission NAC by supplying its UAC Infranet Controller with data about application traffic. The controller can correlate the anomalies and threats IDP finds with specific users. Then it can apply policies to mitigate threats. So if a device is the source of a threat, it can be quarantined or have malicious sessions cut off. If the event is less severe, the controller can just log it.

Before, the NAC gear simply wouldn't know about threats found by IDP.

Enterasys integrated its IDP with its intrusion-detection gar in January, and other NAC vendors, such as ConSentry, ForeScout, Insightix and Tipping Point, already offer postadmission NAC.

The new software supports only integration with Juniper's IDP, so customers with IDP gear from another vendor don't gain from this feature, says Andrew Braunberg, an analyst with Current Analysis. He says demand from customers may ultimately push the company toward third-party integration.

Juniper is also announcing that it has a version of its UAC client software that operates with the Microsoft Vista operating system. Previously, it worked with Windows XP and Windows 2000. Braunberg says this does not mean the network-access protection (NAP) client -- Microsoft's name for NAC -- that is built into Vista can substitute for Juniper's UAC client. So customers cannot avoid deploying a separate client if they use UAC.

The new UAC software supports automatically fixing shortcomings in Windows machines that are found out of compliance with the access policies UAC enforces. So if certain files are missing from the machines or certain processes are turned off, the Infranet Controller can fetch them or turn them on. Before, in all cases, if a machine failed its health check, the user had to manually update it.

Along with this, the software can find out more than before about the security posture of the endpoints it checks out. To do this, Juniper is incorporating Shavlik NetChk software in its platform to more thoroughly assess a wide variety of security patches.

All these new features come with UAC 2.1, which is available at the end of the month.