What Is Network Access Control?

NAC answers an important security question:

```

"Should this user/device be allowed
to access this network?" 

Traditional networks often operate on a simple assumption:

```

Device connected
↓
Network access granted 

NAC introduces additional checks:

```

Device connects
↓
Identify device/user
↓
Authenticate
↓
Check security policy
↓
Evaluate device posture
↓
Determine access
↓
Allow / Restrict / Deny 

Why Is NAC Important?

Modern organizations may have many different types of devices:

• Employee laptops
• Desktop computers
• Mobile devices
• Printers
• IP phones
• IoT devices
• Guest devices
• Servers
• Unknown or unauthorized devices

Giving every device identical network access can increase the organization's attack surface.

NAC can help organizations apply different access policies based on identity, device type, authentication, and security requirements.

Basic NAC Architecture

              Authentication Server
                   RADIUS
                      |
                      |
                +-----------+
                |    NAC    |
                |  Policies |
                +-----------+
                      |
                      |
                +-----------+
                |  Switch   |
                +-----------+
                   /     \
                  /       \
               Laptop    Printer
                 |
                 |
             Authentication
    

In many enterprise deployments, NAC functionality is distributed across the endpoint, network access device, authentication server, and policy system.

What Can NAC Check?

NAC policies can consider different types of information, including:

What Is Device Posture?

Device posture refers to the security or compliance state of an endpoint.

Depending on the NAC implementation, posture information may include:

• Operating system information
• Security software status
• Endpoint protection status
• Required security configuration
• Device compliance state
• Other organization-defined security requirements

For example, an organization might define a policy such as:

```

Company laptop
+
Authenticated employee
+
Compliant security posture
=
Normal network access 

A device that does not meet the required policy could instead receive restricted access, remediation access, or be denied, depending on the NAC design.

NAC Access Decisions

Exact behavior depends on the NAC product and organization policy.

NAC and 802.1X

802.1X is one of the important technologies used to provide port-based network access control.

```

Endpoint
|
| 802.1X
v
Switch / Access Point
|
| RADIUS
v
Authentication Server 

802.1X defines the framework for authentication at the network access point. NAC can use the authentication result together with additional policy information to make access decisions.

NAC Benefits

• Controls network access based on identity and policy.
• Reduces unauthorized device access.
• Supports user and device authentication.
• Can separate employees, guests, IoT, and other device types.
• Can support device compliance policies.
• Improves network visibility.
• Supports Zero Trust-style access principles.

NAC and VLAN Assignment

Depending on the implementation, successful authentication can result in different network access policies.

```

Employee
↓
Authentication
↓
Employee VLAN

Guest
↓
Authentication
↓
Guest VLAN

IoT Device
↓
Policy
↓
IoT VLAN 

This allows organizations to combine identity-based access with network segmentation.

NAC vs Traditional Network Access

NAC and Zero Trust

NAC can support a Zero Trust security strategy because it can require authentication and policy evaluation instead of assuming that every device inside the network is trusted.

However, NAC alone is not the same thing as Zero Trust. Zero Trust is a broader security architecture involving identity, policy, continuous evaluation, least privilege, and other controls.

Packet Tracer / Lab Concept

A full enterprise NAC platform may not be available in basic Packet Tracer environments, but students can practice the underlying concepts using 802.1X-capable designs or simulated authentication environments where supported.

Focus on understanding:

1. Endpoint authentication
2. Access switch
3. Authentication server
4. RADIUS communication
5. Authentication success/failure
6. Access policy
7. Network segmentation

Quick Quiz

1. What does NAC stand for?

2. What is device posture?

3. Which authentication technology is commonly associated with NAC?

4. What protocol is commonly used between network access devices and an authentication server?

Key Takeaways

• NAC controls network access using identity and security policies.
• NAC can evaluate users, devices, and device posture.
• 802.1X is a common technology used for network access authentication.
• RADIUS is commonly used as the authentication protocol between network access devices and an authentication server.
• NAC can support VLAN assignment and network segmentation.
• NAC can provide different access for employees, guests, IoT devices, and non-compliant endpoints.
• NAC can support Zero Trust principles but is not itself the entire Zero Trust architecture.