Good question. SDN can be used to enforce NAC. So, yes they can co-exist.
Then this will mean the communications is to the SDN controller from the NAC. Normally NAC will send 802.1x messages to the switch to enable/disable the ports. By the introduction of SDN, these same messages must go toward the Controller as the intermediary before the switch port is enabled. I would like to see a message flow in a case like this.
A side note: An SDN can do wonderful or terrible things to a network. A TRULY SECURE real time exec is needed in any SDN (OpenFlow) controller. I am working on using seL4 (see: http://www.ertos.nicta.com.au/research/l4.verified/pubs.pml) as the exec for SND/OpenFlow conrollers with embedded Erlang as the application language.
"Normally NAC will send 802.1x messages to the switch to enable/disable the ports. By the introduction of SDN, these same messages must go toward the Controller as the intermediary before the switch port is enabled. I would like to see a message flow in a case like this."
One approach to this could be to incorporate the NAC as part of the SDN controller. Obviously there may be performance issues, depending on how you implement it.
As examples there are SNAC (http://www.openflow.org/wp/snac/), and Resonance
(http://www.gtnoise.net/papers/2009/nayak:res:wren09.pdf)
- Badges
- Science topic
- Similar topics
- Chemistry
- Pharmacology
- Medical Pharmacology
- Clinical Pharmacology