Network Access Control (NAC): How It Works, 802.1X and Rollout

What Is Network Access Control?

Network access control, NAC for short, checks every device that wants to connect to the company network, whether by network cable or Wi-Fi. Only after the check does the system decide whether the device may join and where it may go.

Without NAC, a free network socket in a meeting room is often enough. Whoever plugs in a laptop there is on the internal network. With NAC, the port stays locked until the device has identified itself.

NAC answers three questions:

• Who or what is this? The user and the device are recognized and authenticated.
• Is the device secure? The system checks, for example, updates, antivirus and encryption.
• What may it do? Depending on the result, there is full access, a limited area or nothing at all.

How NAC Works

1. Detection: a device connects to a switch port or to Wi-Fi.
2. Authentication: the device identifies itself, ideally with a certificate. Otherwise with a user name and password or its MAC address.
3. Health check: the NAC system checks whether the device meets the rules. This check is also called a posture assessment.
4. Authorization: the system assigns the device to a suitable network area, for example by VLAN or access list.
5. Ongoing control: the device is also watched after it has logged on. If its state changes, its access changes too.

An example: an employee plugs in their company laptop. The certificate fits, the updates are current, and the laptop joins the office network. A visitor plugs in a private device. It has no certificate and ends up in the guest network with internet access only. A laptop without current antivirus goes into quarantine until it has been fixed.

802.1X and RADIUS

The most important method behind NAC is the IEEE 802.1X standard. It controls logons at network ports and in Wi-Fi. Three roles work together:

• Supplicant: the device that wants to join the network, such as a laptop.
• Authenticator: the switch or Wi-Fi access point. It keeps the port closed until approval comes.
• Authentication server: usually a RADIUS server. It checks the login data and reports the result back.

The logon itself runs over the Extensible Authentication Protocol (EAP). EAP-TLS is the most secure option: the device and the server prove their identity to each other with certificates. Password-based methods are easier to set up, but weaker.

Many devices cannot do 802.1X, such as older printers, cameras or machines. For them, there is MAC authentication bypass (MAB). Here, the device is recognized by its MAC address. Since MAC addresses can be faked, such devices should only go into a tightly limited network segment.

Types of NAC

• Pre-admission: the device is checked before it may join the network.
• Post-admission: the device is also monitored during operation and restricted if it breaks the rules.
• Agent-based: a small piece of software on the device reports details such as updates and antivirus.
• Agentless: the system recognizes devices by their network traffic. This suits printers, phones and IoT devices.

Adaptive NAC

Classic NAC checks once at logon. Adaptive NAC goes further: it keeps rating devices and adjusts access to the current situation.

For this, the NAC system shares information with other security tools. If an EDR system reports malware on a laptop, for example, NAC moves the device to quarantine automatically. A SIEM can raise the alarm as well. This turns a one-time door check into ongoing oversight. The approach fits zero trust well: trust is never granted for good.

NAC, Firewall and ZTNA

• NAC: controls which devices may connect to the local network, meaning at the switch port and in Wi-Fi.
• Firewall: controls traffic between networks and zones.
• ZTNA: controls access to single applications, no matter where the user is. See zero trust network access.

The three work together. NAC makes sure only known devices join the network in the office. ZTNA protects access on the road. The firewall separates the zones.

Benefits of NAC

• Overview: you know at any time which devices are on your network.
• Smaller attack surface: unknown devices do not get onto the internal network.
• Fast response: infected devices can be isolated at once.
• Guests and own devices: visitors and private devices (BYOD) end up in their own area automatically.
• Proof: logs show who was connected and when. This helps with audits under ISO 27001 or NIS-2.

Challenges

• Old devices: printers, machines and medical devices often do not support 802.1X.
• Certificates: EAP-TLS needs a public key infrastructure (PKI) that must be maintained.
• Outage risk: if the RADIUS server fails, no one can get onto the network. It must therefore be redundant.
• Effort: inventory, rules and exceptions take a lot of time at the start.
• Acceptance: rules that are too strict and poorly explained lead to frustration and workarounds.

Rolling Out NAC in Five Steps

1. Take stock: which devices are there, and which of them can do 802.1X?
2. Define zones: for example office, servers, production, guests and quarantine. See network segmentation.
3. Start in monitor mode: at first, the system only logs and blocks nothing. This shows gaps without disrupting operations.
4. Enforce step by step: first the Wi-Fi or one site, then the rest.
5. Maintain it: check new devices, exceptions and rules on a regular basis.

Conclusion

Network access control makes sure only known and secure devices get onto the company network. The basis is usually 802.1X with a RADIUS server. Adaptive NAC also keeps checking and responds to threats automatically. If you roll it out step by step and start in monitor mode, you avoid outages and quickly gain an overview.