Solved

NAC exclusions for Qualys scans

  • 5 June 2019
  • 6 replies
  • 255 views

Hello everybody,

I can use your advice or help.

When we run a Qualys scan, it produces random MAC addresses and tries "logging" into some of the appliances for vulnerability testing.

This starts chewing up a chunk of our NAC licenses.

Is there a way to exclude the Qualys scanner IPs or MAC from the NAC so as to not occupy NAC licenses and keep things clean in general?

Any advice or assistance is greatly appreciated!

Thank you,
Billy
icon

Best answer by Tomasz 6 June 2019, 00:54

Hi Billy,

If we are talking about EXOS switches (are we?) the authentication is enabled globally and then you select ports in which you want to authenticate connected devices.
I don't see right now a way to use authentication with Extreme Access Control and not have an end-system in the cache that is used to calculate license usage. You can just 'exclude' ports on which the appliance is connected, by disabling authentication on these ports (or doing 'auth-override' to have just one MAC address authenticated, in the end-system table and consuming end-system license).

Hope that helps,
Tomasz
View original

6 replies

Userlevel 7
Disable auth on the port the Q thing is connected to ?!
Hi Ron,

Thank you for taking the time to reply to my post!

By doing so, the NAC tells the switch to just let the traffic pass?
So there is no "Exclusion" setting but by disabling authorization on the port in of itself might be an exclusion?

Full Disclosure: I'm not the Network Admin and I don't have rights to the UI... but I'm trying to help them out.

Billy
Userlevel 5
Hi Billy,

Disabling authentication on a port (not globally for the entire device!) means the MAC address will be passed through according to static port configuration (PVID, Policy, ACLs etc.). This is the way for exclusion as even if you planned to assign 'Full Access' policy to the device, any authentication request will always end up in NAC end-system table. When Extreme Access Control is an AAA server from the switch perspective, it receives all the authentication requests and that's how it learns of the connected end-system, and that's how your licenses can get saturated. So as Ron said, disabling authentication on the port to Qualys scanner might be helpful.
You can disable authentication and if you wish to run scans from particular user role perspective, you can assign policy/VLAN statically to a port for scanning time.
On EXOS switches you can also assign a policy role with 'HTTP Aware' (aka 'auth-override') flag, so only the first MAC seen on a port will be authenticated, and all the rest on that port will be treated according to the same policy.

Hope that helps,
Tomasz
Hi Tomasz,

I appreciate the detail you put in your post!

Would you elaborate on this sentence some more?
Disabling authentication on a port (not globally for the entire device!)

Does that mean there is a way to globally exclude the Qualys scanner appliances?

Thank you,
Billy
Userlevel 5
Hi Billy,

If we are talking about EXOS switches (are we?) the authentication is enabled globally and then you select ports in which you want to authenticate connected devices.
I don't see right now a way to use authentication with Extreme Access Control and not have an end-system in the cache that is used to calculate license usage. You can just 'exclude' ports on which the appliance is connected, by disabling authentication on these ports (or doing 'auth-override' to have just one MAC address authenticated, in the end-system table and consuming end-system license).

Hope that helps,
Tomasz
Hi Tomasz,

Thank you for your latest response.
I understand you and Ron have said the same thing a couple times but the way you phrased the answer helped me understand the context better.

Thank you!
Billy

Reply