Network Access Control (NAC)

Network Access Control (NAC) is a set of protocols and technologies that enforce security policy on devices seeking to access network resources. Its primary goal is to ensure that only authorized and compliant devices can connect, thereby reducing the risk of malware, unauthorized access, and data breaches. NAC can be implemented at the network edge (wired switches, wireless access points) or via software agents on endpoints.

The NAC process typically follows a three-phase cycle: Authentication, Posture Assessment, and Enforcement.

1. Authentication: When a device connects to a network port or associates with a wireless SSID, it must authenticate. This often uses 802.1X, which involves three entities: - Supplicant: The client device (e.g., laptop) running 802.1X software. - Authenticator: The network device (switch or wireless access point) that acts as a gatekeeper. - Authentication Server (AS): Typically a RADIUS server (e.g., Cisco ISE, FreeRADIUS) that validates credentials. The supplicant sends an EAP (Extensible Authentication Protocol) message to the authenticator, which forwards it to the AS. The AS authenticates the device (e.g., via username/password, certificate, or MAC address) and responds with an Accept or Reject. If accepted, the AS sends attributes that define the VLAN or ACL to apply.

2. Posture Assessment: After authentication, the device's security posture is checked. This can involve: - Agent-based: A persistent or dissolvable agent on the device scans for antivirus status, OS patches, firewall settings, and running processes. - Agentless: The NAC system performs network scans (e.g., Nmap) or checks via SNMP. - Posture tokens: The AS evaluates the posture and assigns a token (e.g., Healthy, Quarantine, Guest) that determines access.

- Healthy devices → Corporate VLAN (full access) - Non-compliant devices → Quarantine VLAN (limited to remediation servers) - Guest devices → Guest VLAN (internet only)

- Cisco switch 802.1X configuration:

interface GigabitEthernet0/1
   authentication port-control auto
   dot1x pae authenticator
   dot1x timeout tx-period 3

- FreeRADIUS configuration snippet:

authorize {
    files
    eap {
      ok = return
    }
  }

Posture checks can include:

Example of a posture policy (Cisco ISE):

Rule: Windows_Compliant
Condition: (Windows) AND (Antivirus_Installed == true) AND (AV_Definitions_Updated == true) AND (OS_Patches >= Critical)
Result: PermitAccess

Wireless NAC uses 802.1X with EAP methods. The wireless access point acts as the authenticator. Common EAP types: - EAP-TLS: Requires client and server certificates; strongest security. - PEAP-MSCHAPv2: Uses server certificate and username/password; vulnerable to credential theft if server certificate is not validated. - EAP-FAST: Uses a PAC (Protected Access Credential) for tunneling.

IoT devices often lack 802.1X supplicants. Solutions include: - MAB: Uses MAC address; easily spoofed. - Device profiling: NAC identifies device type via OS fingerprinting, DHCP fingerprinting, or HTTP user-agent. - Certificates: Pre-provision certificates on IoT devices.

NAC is a critical defense against unauthorized access and non-compliant devices. SY0-701 expects you to understand the 802.1X authentication process, posture assessment, and enforcement mechanisms. Know the roles of supplicant, authenticator, and authentication server. Be able to identify scenarios where NAC would prevent a rogue device from connecting.

A hospital's network team notices unusual traffic from the medical imaging VLAN. They check the NAC logs and see an unknown MAC address that successfully authenticated via MAB. The switch logs show the device was assigned to the imaging VLAN. The analyst uses the NAC's device profiling feature to fingerprint the device: it appears as a generic Linux machine, not a known medical device. They quarantine the port and investigate. The root cause: a physician plugged in a personal laptop to the network jack. The NAC had MAB enabled as a fallback, and the MAC address was not in the blacklist. The correct response: disable MAB on sensitive VLANs or require 802.1X for all devices. The common mistake: assuming MAB is secure because MAC addresses are unique. In reality, MAC spoofing is trivial.

A user calls the helpdesk saying they cannot access the corporate file server. The NAC agent on their laptop shows a red status: antivirus is not running. The NAC policy server (e.g., Cisco ISE) detects this and automatically moves the laptop to a quarantine VLAN. The user can only access the remediation server to install antivirus. The helpdesk walks the user through enabling antivirus. After the agent reports compliance, the NAC server sends a CoA to the switch to move the laptop back to the corporate VLAN. The analyst monitors the ISE live logs and sees the transition. Common mistake: The helpdesk might try to manually assign the user to the corporate VLAN via switch CLI, bypassing NAC. This is a security violation and should be prevented by strict change control.

A company uses EAP-TLS for wireless authentication. Users start reporting they cannot connect to the corporate Wi-Fi. The NAC logs show repeated authentication failures with reason 'certificate expired'. The IT team checks the CA and finds that client certificates were issued with a 1-year validity and many have expired. They renew certificates via Group Policy auto-enrollment. The analyst also notices that the RADIUS server logs show increased failed attempts from devices with expired certs. The correct response: implement certificate auto-enrollment and monitor certificate expiry. Common mistake: Blaming the wireless AP or supplicant configuration without checking certificate validity.