Before I recommend a NAC implementation at my company, I'd like to know more about what NAC can and can't do.

Given all the hype surrounding NAC, it's important to sort through both the capabilities NAC can provide you and the LAN security requirements you have. Different NAC architectures lend themselves to solving different business problems, and ultimately, you need to map your needs to the right architecture.

NAC got its start as an admission control technology, authenticating users and scanning their machines for security compliance before allowing them onto the LAN. And frankly, much of the industry discussion of NAC remains focused on this limited definition of the technology.

But NAC designed as a full network access control solution can do a lot more than simply control who comes onto the LAN. It can help you restrict what people can do after they're already on your LAN - controlling what servers they can reach, what data they can access, and even what applications they can run.

The extent of control you can wield in a NAC solution will depend heavily on its architecture. If all you need is simple guest access control - that is, restricting those who are "not one of us" to the Internet and letting those who are "one of us" go anywhere on the LAN - then a simple, out-of-band architecture can easily meet those needs.

If you need more control, restricting what users can do after they are on the LAN, then investigate inline NAC architectures. Since these devices see all the traffic passing through them, they provide a much stronger baseline for control. How much you'll be able to control is still determined by the feature set of a given vendor. For instance, application understanding is critical to controlling users, but some NAC solutions see applications only via Layer 4 information while others decode applications at Layer 7. The greater the feature set, the greater the control you'll have.

You asked what NAC can and can't do for you. A full-featured access control solution should let you perform the following functions:

* Control who can get onto your LAN and limit what resources they can reach;

* Protect your valuable IP;

* Limit the reach of less-trusted or less-known users, such as contractors, technicians, remote users, or offshore workers;