This session covers the principles and design aspects of identity-based networking based on the IEEE 802.1x standard, which allows enterprise network administrators to explicitly control who and what gets on their networks. Identity services are technology solutions with tools to improve the security of physical and logical access to LANs. The Cisco Identity Based Networking Services (IBNS) solution incorporates all of the capabilities defined in 802.1x and provides enhancements and extensions for improving identity-based access control. Important extensions discussed include the ability to provide interoperation with IP telephony and the ability to track when and where anyone gets onto an enterprise network. Identity services are a requisite technology for network admission control (NAC).

This session focuses on the network security issues surrounding Layer 2, the data link layer. Because many network attacks originate inside the corporate firewall, exploring this soft underbelly of data networking is critical for any secure network design. Issues covered include Address Resolution Protocol (ARP) spoofing, MAC flooding, VLAN hopping, Dynamic Host Configuration Protocol (DHCP) attacks, and Spanning Tree Protocol concerns. Common myths about Ethernet switch security are addressed and specific security lockdown recommendations are provided. Attack mitigation options presented include the new DHCP snooping and Dynamic ARP Inspection (DAI) functionality. Attendees can expect to learn Layer 2 design considerations from a security perspective and mitigation techniques for Layer 2 attacks. This session is for network designers, administrators, and engineers in all areas of data networking.

This session introduces the key components and builds the core concepts required to understand and implement Cisco's Network Admission Control (NAC). A functional overview of the solution and its deployment in various scenarios such as VPN, Wireless, Branch & Campus will be covered . The session introduces you to end point profiling and guest life cycle management. Participants who this breakout may be interested in BRKSEC-3040 advanced NAC design.