DATASHEET

Ivanti Policy Secure (NAC)
Total visibility and total security
Highlights■ Centralized visibility and policy managementof all endpoints, including IoT.
■ Granular assessment of endpoint security

posture before allowing access.
■ Dynamic network segmentation based onuser role and/or device class.
■ Seamless roaming between remote andlocal, using Connect Secure Integration.
■ Granular integration with vADC for ascalable, resilient and responsive solution.
■ BYOD onboarding integration with Ivanti

Neurons for Workspace or 3rd party EMM.
■ REST API integration with securityecosystem.
■ Scales for organizations of any size.

Modern networks experience a proliferation ofconnected endpoints; BYOD connectivity is now
surpassed by IoT. Every additional endpoint increases
the risk to be compromised and give attackers anPolicy Secure uses zero trust principles to manage
network access by validating the user and a device’s
security posture, and then connects the device withleast privilege access policy.

opportunity to gain further access into the network

The open platform integrates with a wide range ofand to corporate resources. To limit this risk, answitching, Wi-Fi and NGFW solutions to enforce

endpoint’s security posture must always show current

access policies. Bidirectional integration withsoftware security updates, virus definitions, and so

third-party security solutions improves overall

on. Also, users must only be given the least amount ofsecurity efficacy with automated endpoint access

access necessary to perform their role.

enforcement.

Ivanti Policy Secure provides complete visibility

Automated responses to Indicators of Compromiseand Network Access Control (NAC) for all local or(IoC) reduces remediation time and streamlines

remote endpoints. Its open, high-performance design

administrative resources. PPS integrates with ahelps small and large organizations easily enforce

wide range of NGFWs such as Palo Alto Networks,

endpoint security compliance and zero trust security.

Checkpoint, Juniper and Fortinet, as well as SIEM

The intuitive UI makes for easy administration andsolutions like IBM Qradar and Splunk. Integration

customizable reporting.

with McAfee ePolicy Orchestrator (McAfee ePO)

Policy Secure continuously enforces foundational
security policies and controls network access forivanti.com

managed and unmanaged endpoints, including IoT.

fortifies endpoint management and automated threatresponse. For granular OT/IIoT visibility and control,
PPS integrates with Nozomi Guardian.

Benefits■ End-to-end zero trust network accesssecurity.
■ Reduced threat response time.
■ Reduced risk from lateral spread of threats.
■ Automated policy enforcement, reducedauditing burden.
■ Simple and fast deployment.

Figure 1: Access decisions for endpoints

Key components
The Policy Secure solution includes three components:■ Profiler identifies and classifies endpoint devices,

including IoT. It provides end-to-end visibility,
reporting and behavior analytics.
■ Policy Secure provides a high-performance policy

engine that leverages contextual information fromusers, endpoints and applications. With a unified,■ Client offers agent and agentless options forlocation, device type or device ownership. Users enjoy

pre- and post-admission control. The solution

greater productivity and the freedom to work anywhereincorporates the host checker functionality, which

without limiting access to authorized network resources

verifies an endpoint’s security posture. This isand applications. BYOD onboarding optimizes the user

the same Client used for our Connect Secure

experience by allowing workers to use their preferred

VPN solution and runs on Windows, Mac, Linux,device. Policy Secure provides complete visibility ofAndroid and IOS platforms.

managed and unmanaged network devices.

Use case overview

open framework and policy engine, administrators

Policy Secure helps to adapt zero trust network

can apply granular rules for dynamic monitoring,access security for small and large organizations inreporting and access control of all endpoints,

the Everywhere Workplace. Enterprises use Policy

anywhere on the network, to minimize access risks.

Secure to enforce endpoint policy compliance foremployees, guests and contractors regardless ofIvanti Policy Secure (NAC) | Datasheet

2Visibility

CHALLENGES

POLICY SECURE SOLUTION

To protect your network endpoints, you need to see
what endpoints are connected. Complete visibility

Profiler dynamically identifies and enables automatic and custom

means having the insights to identify and classify allclassification of both managed and unmanaged endpoint devices. This

managed and unmanaged endpoints.

Profiling

provides operational visibility, reporting and policy-based controlled accessto networks and resources based on the user, device, applications and otherattributes.
Profiler continuously performs behavioral analytics and builds baseline

Behavioral analytics

behavior profiles for IoT devices by collecting and correlating NetFlow,user, and device data. This is used to detect anomalous device activity,
anomalous user access, domain generation attacks and MAC spoofing.
Profiler can automatically classify devices against a growing database ofNumerous device types

more than 2.3M unique fingerprints. The solution profiles endpoints’ staticor dynamic IP addresses and actively scans open ports to detect MACspoofing.

The Internet of Things (IoT)

CHALLENGES

POLICY SECURE SOLUTIONEnterprises today merge IoT devices with the IT
environment to improve business. Policy Secure offers

Profiler discovers managed and unmanaged IoT devices. It profiles thementerprises the ability to discover and secure these

Discovery, profiling andso they can be matched to specific access policies. Dynamic segmentation

devices.

segmentation of IoT devices

limits the risk of threats spreading laterally and helps with regulatorycompliance.

Ivanti Policy Secure (NAC) | Datasheet

3

Device onboarding and policy
compliance
Policy Secure prevents unauthorized network,
application or data access by dynamically assessing
and remediating device security before the device
connects to the enterprise for both VPN and Wi-Fi
access. This protects the corporate network from
infected devices and enforces consistent, crossnetwork access policies. It also ensures only authorized
workers have access to enterprise resources based on
their role, location and time of day.

Figure 2: Dynamic access control and network segmentation (L2)

Figure 3: Dynamic access control at perimeter (L3)

Ivanti Policy Secure (NAC) | Datasheet

4

CHALLENGES

POLICY SECURE SOLUTION

Guest user support

Policy Secure provides a self-service portal with a customizable interface. It is a highly scalable enterprise guest access platform that supports
thousands of guest users. For additional control, secure guest access can be enabled by an admin (e.g. a receptionist), or by a sponsor who
approves the guest’s access request. Policy Secure integrates with wireless controllers like Aruba, Cisco, Huawei, Juniper Mist, Meraki and Ruckus.

BYOD onboarding

Policy Secure empowers employees to use their personal devices for work with self-service onboarding of personal laptops and mobile devices.

KEY FEATURES
Profiler

Identifies and classifies endpoint devices, including IoT. It provides end-to-end visibility, reporting and behavior analytics.

RADIUS/802.1X

An integrated, high-performance RADIUS authenticates users and devices that are forwarded from industry-standard 802.1X functions onsupport

network switches and wireless controllers.

TACACS+ support

Use the TACACS+ authentication system to distribute policies to the access infrastructure. Supports two-factor authentication with smart cards.

Host checker

Identifies the security posture of the device. Options include OS or software patch status and active apps.

Session federation

Active VPN sessions seamlessly migrate to the local network without the need to re-authenticate.

UEBA Analytics

Correlation of user access, device data and system logs in a new analytics engine integrates with the Ivanti One management solution.

Identity-based

Shares identity context with NGFWs from vendors such as Fortinet, Palo Alto Networks, Checkpoint and Juniper SRX, enabling each to beadmission control

employed as policy enforcement points on the network perimeter.

Automated threat

Leverages external threat intelligence alerts from NGFW or SIEM solutions to take automated actions at the device connection level. Policy engine

responseleverages rich contextual information to allow various mitigating actions based on threat severity.

Captive portal

Provides user-friendly access control for guests and contractors.

Ivanti Policy Secure (NAC) | Datasheet5KEY FEATURES
Self-service guest
access support

Provides secure, simple and differentiated guest access.
ivanti.com

Wizard-based

Simplifies configuration tasks for administrators to avoid mistakes and fasterconfiguration

deployment.
Granular logging capabilities of system, user and device events in a clear, easy-to-

Granular auditing

understand format. Can be analyzed locally or shared with external syslog solutions

and logging

or SIEMs such as IBM Qradar and Splunk. Supports WELF format and WELF-SRC2.0-Access Report.

Centralized policy
management

REST API

Saves administrative time and cost and delivers a superior user experience withcommon remote and local access control policy implementation and enforcement
across a distributed enterprise.
Standardized interface for third-party systems such as NGFWs and SIEMs tointegrate with Policy Secure and limit an endpoint’s access on the local network.

Flexible deployment

Policy Secure runs on physical, virtual and cloud platforms. See the Supported

options

Platforms Guide for details.

Copyright © 2021, Ivanti. All rights reserved. IVI-2523 4/21 RD/SP/FG

1 800 982 2130
sales@ivanti.com