Nortel next month is expected to start revitalizing its enterprise switching business by introducing a new endpoint security product, which may be followed by a series of LAN resiliency and security announcements throughout the year.

The new Secure Network Access Switch (SNAS) is an appliance that works with LAN switches to block or quarantine potentially dangerous devices without requiring permanent client software on PCs, laptops or other devices. Observers say this clientless approach gives Nortel a competitive multi-vendor network access control (NAC) offering.

"Nortel needed to do something like this," says Zeus Kerravala, an analyst with The Yankee Group. After a tumultuous year of executive shakeups, laying out a switching road map with a focus on security should help - at least somewhat - to eliminate concerns about the vendor's enterprise intentions.

How Nortel wants to upgrade switch security - Interview with Sanjeev Gupta, director of Nortel's Ethernet switching business.

Additional announcements expected from Nortel include the ability to run full Check Point firewall or Sourcefire intrusion-detection system (IDS) and intrusion-prevention system (IPS) packet inspection on every port on core Nortel switches. Also planned is near-SONET-speed failover for switches with Nortel's redundancy protocol, Split Multi-Link Trunking, as well as added support for SMLT across more product lines.

Nortel's SNAS - in beta and set for release in mid-February - is a network appliance that attaches to an aggregation-layer switch and controls network access through wiring closet-level switches at the LAN edge.

When a machine accessing a LAN requests an IP address from a local DHCP server, the connection is directed to an SNAS, which authenticates the device and downloads a temporary Java applet to the machine. This software, which deletes itself after logoff, inspects the machine and verifies its anti-virus status and other software profiles (see graphic).

"It's very easy to administer because you don't have to manage clients," says Pat Patterson, director of Nortel's enterprise security solutions group. "Most solutions we've seen that try to use a clientless approach require all traffic to go through an appliance. . . . Our approach won't screw up [a customer's] latency-sensitive traffic by creating that kind of bottleneck."