Network Access Control: Design and Implementation

Introduction

Network Access Control (NAC) is the policy enforcement layer that decides which devices can join your network and with what access level. A modern enterprise network can't just use 802.1X authentication alone — it needs to also verify device health (Is it patched? Does it have antivirus? Is it managed?). This guide covers designing and deploying a comprehensive NAC solution.

NAC Architecture

TEXT

Device attempts to connect
         ↓
Authentication (802.1X / MAC)
         ↓
Posture Assessment (device health check)
    ├── Pass: Full network access (Corporate VLAN)
    ├── Partial: Limited access (Quarantine VLAN for remediation)
    └── Fail: Guest VLAN only (internet access only)
         ↓
Continuous monitoring (check periodically, revoke if compromised)

Cisco ISE (Identity Services Engine)

Cisco ISE is the most common enterprise NAC solution:

TEXT

ISE Components:
- Policy Administration Node (PAN): Configuration and UI
- Policy Service Node (PSN): Authentication and authorization
- Monitoring and Troubleshooting Node (MnT): Logging and reports

Integration points:
- Active Directory: User identity and group membership
- RADIUS: 802.1X authentication with switches/APs
- MDMMDM (Intune/Jamf): Device management status
- Vulnerability scanners: Device patch status

Policy Design

TEXT

NAC Policy Matrix:

Device Type   | Auth Method  | Posture     | Assigned Network
--------------|--------------|-------------|------------------
Managed Corp  | 802.1X cert  | Compliant   | Corporate VLAN 10
Managed Corp  | 802.1X cert  | Non-compliant| Remediation VLAN 50
BYOD (employee)| 802.1X cred | Registered  | BYOD VLAN 30
BYOD (employee)| 802.1X cred | Unregistered| Guest portal
Contractor    | Guest portal | -           | Contractor VLAN 40
Unknown device| MAC auth     | -           | Guest VLAN 99
IoT device    | MAC auth     | -           | IoT VLAN 60

Posture Checks

TEXT

Minimum device requirements (example policy):
- Windows: OS version ≥ Windows 10 21H2
  Latest security patches (within 14 days)
  Windows Defender enabled and updated
  Disk encryption (BitLocker) enabled
  Corporate AV agent installed and running

- macOS: Version ≥ macOS 12 Monterey
  FileVault encryption enabled
  Gatekeeper enabled
  Corporate MDM profile installed

- Mobile (iOS/Android): MDM enrolled
  Screen lock enabled
  OS version within 1 major version of latest

ISE Policy Configuration (Example)

TEXT

Authorization Policy Rules (evaluated in order):

Rule 1: ISE-Compliant-Employee
  Conditions:
    Identity Group = AD:Domain Computers
    AND Compliance Status = Compliant
    AND AD Group = AD:Employees
  Result:
    VLAN = 10 (Corporate)
    dACL = Full-Access-Policy
    Reauthentication: Every 8 hours

Rule 2: Non-Compliant-Corporate
  Conditions:
    Identity Group = AD:Domain Computers
    AND Compliance Status = Non-Compliant
  Result:
    VLAN = 50 (Remediation)
    dACL = Remediation-Only
    Redirect URL = https://ise.company.com/remediation

Rule 3: BYOD-Employee
  Conditions:
    AD Group = AD:Employees
    AND Device Type = Personal Device
  Result:
    VLAN = 30 (BYOD)
    dACL = BYOD-Policy (internet + email only)

Rule 4: Default
  Conditions: ALL
  Result:
    VLAN = 99 (Guest)
    dACL = Guest-Policy

Guest Access Workflow

TEXT

Guest connects to "Guest-WiFi" SSID
    ↓
Redirect to captive portal (https://guest.company.com)
    ↓
Guest registers: Name, Email, Phone, Host Employee
    ↓
Sponsor (employee) receives email/SMS: "Approve guest access?"
    ↓
On approval: Guest gets limited network access
    - Internet only
    - Duration: 8 hours (or what sponsor set)
    - Can be revoked by sponsor or auto-expires

Guest VLAN policy:
  - Access internet on port 80/443
  - Access DNS (port 53)
  - No access to internal networks
  - Bandwidth limit: 5 Mbps per client

Deploying Posture Agent

TEXT

Cisco AnyConnect + Posture Module:
1. Deploy AnyConnect package via SCCM/Intune
2. ISE profile: download posture module automatically when user connects
3. User connects → ISE detects no posture module → redirects to ISE agent download
4. User installs agent → agent checks device compliance
5. Report sent to ISE → policy applied

Agentless posture (basic, for BYOD):
- ISE checks: OS type/version (from user-agent)
- MDM connector: Is device MDM enrolled?
- No deep checks possible without agent

Troubleshooting NAC

TEXT

# Cisco ISE: View authentication events
# ISE → Operations → RADIUS → Live Logs

# Failed authentications show:
# - Auth failure reason (wrong cert, wrong credentials)
# - Policy matched
# - Authorization result

# Switch: Debug 802.1X
debug dot1x all
show dot1x interface Gi1/0/1

# Check what VLAN was assigned
show authentication sessions interface Gi1/0/1

# ISE posture issues:
# ISE → Operations → Posture → Live Sessions
# Shows posture status, compliance details

# Common issues:
# 1. Certificate not trusted: Install ISE cert in trusted root CA store
# 2. Posture timeout: Increase timeout or check AV scan speed
# 3. MAC auth fallback: Configure when 802.1X times out
# 4. VoIP phones: Use voice VLAN (CDP/LLDP auto-detection)

NAC is complex but the security benefit is enormous: you know exactly what devices are on your network, in what state, and can automatically quarantine non-compliant devices. Start with monitoring mode (log but don't enforce), validate your policy logic, then enable enforcement gradually VLAN by VLAN.