Call it NAC (Cisco’s Network Admission Control) or, well, NAC (network access control), or even NAP (Microsoft’s Network Access Protection). Any way you refer to it, these schemes for shutting out unwanted users at the LAN switch port level are among the most buzzed about network technologies.

Almost all Ethernet vendors offer some sort of NAC technology — even D-Link, SMC and Linksys on the low end. Advanced network product integration, such as Cisco’s NAC or Nortel’s Secure Network Architecture, allow LAN switches to communicate with back-end security gear to filter dangerous or unsecure users and shut down unwanted network activity — in theory. And almost every LAN vendor offers basic network protection features, such as 802.1X, access control lists, and media access control address filtering.

So how much protection a LAN switch can provide to an overall network is really a question of how much protection is needed, and what extra gear is required to make a meaningful impact on LAN security, experts say.

“How much security can NAC provide? I don’t know — say, seven pounds,” jokes Joel Snyder senior partner at Opus One and a Network World Lab Alliance member. In all seriousness, Snyder has extensively tested most NAC products on the market, and says there are four points along the “enforcement spectrum,” or levels of protection that make up NAC.

The first is called “go/no-go”. This is a very basic pass-fail authentication challenge that a switch can provide. “It’s similar to if you try to get on a wireless LAN, but don’t know the WEP key,” Snyder says. Most enterprise switches support the 802.1X protocol, which, when deployed with a back-end RADIUS authentication server, can provide this basic kind of pass/fail NAC protection.

The second level is what Snyder calls virtual LAN “schwinging,” in which users are put on different virtual LANs (VLAN) based on a NAC framework. A campus could be divided into several VLANs, each designated for various departments, or employee levels with certain access privileges. Based on credentials presented at the 802.1X authentication phase, users can be shunted — or “schwinged” — into their proper network segment. This involves a more intelligent back-end server or application, which is able to identify credentials, correlate user identities with access rights, and send commands to LAN switches to adjust switch port VLAN settings accordingly.