Identity and Networking

For the past 15 years or so, the networking industry has been hinting at a vision with a snappy title like “identity-driven networking.” I first heard this concept in the late 1990s, when Cisco came up with its own spin on this theme with an initiative called Directory Enabled Networking (DEN). The thought was that the network would query an LDAP-based network directory to enforce some kind of access control policies based upon user properties stored in network directories. Cisco nailed the vision and was way ahead of its time. So what’s happened since? Things were slow and spotty for a while with a few hints of innovation. Broadband access led to VPNs. Wireless networking led to the need for 802.1X device authentication. Worm storms in 2004 led to a flurry of activity around Cisco’s Network Admission Control (NAC) and Microsoft’s Network Access Protection (NAP) to keep “unhealthy” PCs off the network. Each of these advanced the cause, but rather than fulfill the identity-driven network vision, these were really tactical solutions.Fast forward to 2011. The industry has moved on to 40/100Gb Ethernet, IPv6, virtualization, and cloud computing so you don’t hear much about identity-driven networking anymore, but in point of fact, the vision is coming together. Networks can now recognize multiple types of devices, network location, and user attributes to enforce policies. Critical application traffic can be prioritized on a user-by-user basis while other applications can be blacklisted or rate limited based upon users and groups. VPNs are now automated — no more IPSec clients, user names or passwords — you can get to the network resources you want to from wherever you are.A few leading examples include Cisco AnyConnect VPN, Juniper’s Pulse Client and the Funk Software RADIUS server, and Extreme Networks Identity Manager. Check Point is also doing something similar as a network add-on. We are quickly moving to the service paradigm of identity management where entities like users and devices connect to network services for connectivity, application access, printing, etc. Cloud computing will only accelerate this transition. In this type of architecture, networks have to play a role in “knowing” who or what wants network access, enforce policies based upon this information, and then optimize good traffic and block bad traffic. It is nice to see that we are making real progress.