Datasheet

Ivanti Policy Secure (IPS) and Profiler

Complete visibility and network access control for modern networks, with endpoint profiling, dynamic segmentation and zero trust policy enforcement for managed, unmanaged and IoT devices.

Complete Visibility and Network Access Control
Key Components
Use Case Overview
Visibility
The Internet of Things (IoT)
Device Onboarding and Policy Compliance
Security Standards and Certifications
Additional Key Features

Complete Visibility and Network Access Control

Modern networks experience a proliferation of connected endpoints; BYOD connectivity is now surpassed by IoT. Every additional endpoint increases the risk to be compromised and gives attackers an opportunity to gain further access into the network and corporate resources. To limit this risk, an endpoint’s security posture must always show current software security updates and virus definitions, for example . Also, users must only be given the least amount of access necessary to perform their role.

Highlights

Centralized visibility and policy management of all endpoints, including IoT.
Granular assessment of endpoint security posture before allowing access.
Dynamic network segmentation based on user role and/or device class.
Granular integration with Ivanti vADC for a scalable, resilient and responsive solution.
BYOD onboarding integration with Ivanti Neurons for Workspace or third-party EMM.
REST API integration with network and security infrastructure devices, including switches, wireless LAN controllers and firewalls.
Scales for organizations of any size.

Ivanti Policy Secure (IPS) and Profiler provides complete visibility and Network Access Control (NAC) for all endpoints. Its open, high-performance design helps small and large organizations easily enforce endpoint security compliance and zero trust security. The intuitive UI simplifies administration and provides customizable reporting.

Policy Secure continuously enforces foundational security policies and controls network access for managed and unmanaged endpoints, including IoT. Policy Secure uses zero trust principles to manage network access by validating the user and a device’s security posture and then connects the device with a least privilege access policy.

The open platform integrates with a wide range of switching, Wi-Fi and NGFW solutions to enforce access policies. Bi-directional integration with third-party security solutions improves overall security efficacy with automated endpoint access enforcement.

Automated responses to Indicators of Compromise (IoC) reduce remediation time and streamline administrative resources. Policy Secure integrates with a wide range of NGFWs including Palo Alto Networks, Checkpoint, Juniper and Fortinet, as well as SIEM solutions like Qradar and Splunk. Integration with McAfee ePolicy Orchestrator (McAfee ePO) fortifies endpoint management and automated threat response. For granular OT/IoT visibility and control, Policy Secure integrates with Nozomi Guardian.

Benefits

End-to-end zero trust network access security.
Reduced threat response time.
Reduced risk from lateral spread of threats.
Automated policy enforcement, reduced auditing burden.
Simple and fast deployment.

Key Components

Network access control diagram showing how security policies govern access to protected resources. At the top, Policy Secure connects to an L2 Access Network and provisions network and security policies. The access network communicates with a Firewall, which controls access to protected resources on the right. Three data categories are shown: General Data (allowed, check mark), Finance Data (denied, X), and Customer Data (allowed, check mark). User devices at the bottom connect through the L2 Access Network, illustrating policy-based access decisions that grant or restrict access to different resources. — Figure 1: Access decisions for endpoints

The Policy Secure and Profiler solution includes three components:

Profiler identifies and classifies endpoint devices, including IoT. It provides end-to-end visibility, reporting and behavior analytics.
Policy Secure provides a high-performance policy engine that leverages contextual information from users, endpoints and applications. With a unified, open framework and policy engine, administrators can apply granular rules for dynamic monitoring, reporting and access control of all endpoints, anywhere on the network, to minimize access risks.
Client offers agent and agentless options for pre- and post-admission control. The solution incorporates the host checker functionality, which verifies an endpoint’s security posture. This is the same Client used for the Ivanti Connect Secure VPN solution and runs on Windows, Mac, Linux, Android and iOS platforms.

Use Case Overview

Challenges	Policy Secure and Profiler Solution
Profiling	Profiler dynamically identifies and enables automatic and custom classification of both managed and unmanaged endpoint devices. This provides operational visibility, reporting and policy-based controlled access to networks and resources based on the user, device, applications and other attributes.
Numerous device types	Profiler can automatically classify devices against a growing database of more than 2.3M unique fingerprints. The solution profiles endpoints’ static or dynamic IP addresses and actively scans open ports to detect MAC spoofing.

Visibility

To protect your network endpoints, you need to see what endpoints are connected. Complete visibility means having the insights to identify and classify all managed and unmanaged endpoints.

Challenges	Policy Secure and Profiler Solution
Discovery, profiling and segmentation of IoT devices	Profiler discovers managed and unmanaged IoT devices. It profiles them so they can be matched to specific access policies. Dynamic segmentation limits the risk of threats spreading laterally and helps with regulatory compliance.

The Internet of Things (IoT)

Enterprises today merge IoT devices with the IT environment to improve business efficiencies. Policy Secure offers enterprises the ability to discover and secure these devices.

Standard	Certification Details
NIST / FIPS	Certified by using openSSL.org FIPS provider/module in IPS 22.7R1 release or later.
NIAP	Certified as Compliant Product, IPS 22.2 or later.

Device Onboarding and Policy Compliance

Network access control diagram showing policy-based device authentication and VLAN assignment. An IAM (Identity and Access Management) system communicates with Policy Secure using SAML/AD etc. Policy Secure connects to a Network Access (L2) layer using 802.1x/SNMP. From the network access layer, devices are evaluated and assigned access based on compliance status: a Laptop is allowed access to a VLAN (check mark), an IoT device is allowed access to a VLAN (check mark), and a Non-compliant Endpoint is denied access (prohibition symbol). Arrows illustrate the flow of authentication, policy enforcement, and network access decisions. — Figure 2: Dynamic access control and network segmentation (L2)

Policy Secure prevents unauthorized network, application or data access by dynamically assessing and remediating device security before the device connects to the enterprise. This protects the corporate network from infected devices and enforces consistent, cross-network access policies. It also ensures only authorized workers have access to enterprise resources based on their role, location and time of day.

Security Standards and Certifications

Ivanti Policy Secure and Profiler adheres to National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and National Information Assurance Partnership (NIAP) standards to help ensure the security and interoperability of systems and products, and to protect the confidentiality, integrity and availability of data.

Network security architecture diagram showing integration between identity management, policy enforcement, network access, and corporate resources. On the left, an IAM system communicates with Policy Secure using SAML/AD etc. Users, devices, things, and services connect through Network Access (L2), where authentication occurs. Policy Secure exchanges information with the network access layer and sends API Configuration to a Next-Generation Firewall (NGFW). The NGFW controls access to Corporate Resources on the right. Arrows illustrate authentication, policy enforcement, and traffic flow between identity services, network access infrastructure, firewall controls, and protected resources. — Figure 3: Dynamic access control at perimeter (L3)

Challenges / Key Features	Policy Secure and Profiler Solution
Guest user support	Policy Secure and Profiler provides a self-service portal with a customizable interface. It is a highly scalable enterprise guest access platform that supports thousands of guest users. For additional control, secure guest access can be enabled by an admin, such as a receptionist, or by a sponsor who approves the guest’s access request. Policy Secure integrates with wireless controllers like Aruba, Cisco, Huawei, Juniper Mist, Meraki and Ruckus.
BYOD onboarding	Empowers employees to use their personal devices for work with self-service onboarding of personal laptops and mobile devices.
Profiler	Identifies and classifies endpoint devices, including IoT. It provides end-to-end visibility, reporting and behavior analytics.
RADIUS/802.1X support	An integrated, high-performance RADIUS authenticates users and devices that are forwarded from industry-standard 802.1X functions on network switches and wireless controllers.
TACACS+ support	Use the TACACS+ authentication system to distribute policies to the access infrastructure. Supports two-factor authentication with smart cards.
Host checker	Identifies the security posture of the device. Options include OS or software patch status and active apps.
Identity-based admission control	Shares identity context with NGFWs from vendors such as Fortinet, Palo Alto Networks, Checkpoint and Juniper SRX, enabling each to be employed as policy enforcement points on the network perimeter.
Automated threat response	Leverages external threat intelligence alerts from NGFW or SIEM solutions to take automated actions at the device connection level. Policy engine leverages rich contextual information to allow various mitigating actions based on threat severity.
Captive portal	Provides user-friendly access control for guests and contractors.

Additional Key Features

Key Feature	Description
Self-service guest access support	Provides secure, simple and differentiated guest access.
Wizard-based configuration	Simplifies configuration tasks for administrators to avoid mistakes and faster deployment.
Granular auditing and logging	Granular logging capabilities of system, user and device events in a clear, easy-to-understand format. Can be analyzed locally or shared with external syslog solutions or SIEMs such as Qradar and Splunk. Supports WELF format and WELF-SRC-2.0-Access Report.
Centralized policy management	Saves administrative time and cost and delivers a superior user experience with common remote and local access control policy implementation and enforcement across a distributed enterprise.
REST API	Standardized interface for third-party systems such as NGFWs and SIEMs to integrate with Policy Secure and Profiler and limit an endpoint’s access on the local network.
Flexible deployment options	Policy Secure and Profiler runs on physical, virtual and cloud platforms. See the Supported Platforms Guide for details.